In short: Elementor, the most widely installed WordPress page builder with more than 10 million active installs, had a critical CSRF vulnerability (CVE-2026-62062, CVSS 8.8) that lets an attacker take over a site entirely — a site administrator just has to click one malicious link while logged into the dashboard. Versions 4.3.0 and 4.3.1, already running on more than 2 million sites, are affected. A fix shipped September 24, 2026 in version 4.3.2 — update immediately.
What happened
A security researcher going by the handle Saggre discovered the flaw and reported it to Patchstack, a WordPress plugin vulnerability disclosure service, on September 22, 2026. Elementor's developers shipped a fix in version 4.3.2 just two days later, on September 24, and technical details became public on September 25.
The issue was assigned CVE-2026-62062 with a CVSS score of 8.8 — a critical rating. According to security outlets including The Hacker News and BleepingComputer, the vulnerable versions 4.3.0 and 4.3.1 were running on more than 2 million sites at the time of disclosure, out of the more than 10 million sites where Elementor is active worldwide.
How the attack works: one link, full site takeover
Technically this is a CSRF (Cross-Site Request Forgery) vulnerability that bypasses WordPress's built-in REST API protections. The attack chain is deceptively simple:
- An attacker crafts a malicious link and gets a site administrator to open it — via a phishing email, a chat message, or a forum comment;
- If the administrator is logged into the site's dashboard at that moment (which happens often in practice, since sessions are rarely closed manually), their browser automatically performs an action their account is permitted to take, via the REST API;
- The result: a new administrator account under the attacker's control is created on default installations;
- From there, the attacker has full administrative access — they can alter content, install malicious plugins, harvest visitor data, or use the site as a launchpad for further attacks.
The key danger of CSRF attacks is that the victim doesn't need to download anything or explicitly agree to anything — one click while an admin session is active is enough. No mass exploitation in the wild had been reported at the time of this article, but a separate Elementor Pro flaw disclosed in August 2026 — which Wordfence blocked over 190,000 exploitation attempts against within days — shows how quickly attackers weaponize this kind of bug once technical details go public.
Why this matters even if you don't run Elementor yourself
WordPress, powered by plugins like Elementor, runs a significant share of all websites — from personal blogs to online stores and corporate sites. A compromised site isn't just an admin's problem: attackers routinely use hijacked sites to host phishing pages, malware, and hidden scripts that harvest visitor credentials and payment data. If you simply browse WordPress sites — a huge share of the web — you're exposed too: a compromised site could try to steal your data through a fake login form or silently load a malicious script.
What to do right now
- If you run a WordPress site with Elementor, update the plugin to version 4.3.2 or later immediately via the dashboard (Plugins → Elementor → Update).
- Audit your administrator account list after updating — unfamiliar accounts with admin rights are a sign the flaw may already have been exploited.
- Don't click unfamiliar links while logged into your site's admin dashboard — log out of the dashboard when you're done working rather than leaving the session open indefinitely.
- As an ordinary site visitor, stick to basic hygiene: don't enter credentials into suspicious login forms, keep browser-level antivirus current, and use two-factor authentication on your own important accounts where possible.
- Encrypt your own connection independently of the sites you visit. LiMP VPN can't fix a vulnerability on a site you visit, but it encrypts your traffic before it leaves your device and masks your real IP address — reducing the risk of interception on intermediate network nodes if a site you visit turns out to be compromised. See plans for details.