Elementor users should update the free Elementor plugin to version 4.3.2 or newer: CVE-2026-62062 affects versions 4.3.0 and 4.3.1 and can let an attacker bypass WordPress REST API nonce protection after a logged-in administrator clicks a crafted link. On a standard site, that may allow the attacker to create another administrator account.
Key takeaways
- Only Elementor 4.3.0 and 4.3.1 are affected by this specific vulnerability.
- Elementor 4.3.2 contains the fix and is the minimum safe release for this issue.
- The attack requires user interaction: a logged-in privileged user must open a crafted link.
- The bypass can affect WordPress core and plugin REST routes, not only Elementor’s own API endpoints.
- No confirmed active exploitation was identified in the sources reviewed at publication time.
What is CVE-2026-62062?
CVE-2026-62062 is a cross-site request forgery vulnerability in the free Elementor Website Builder plugin. Patchstack published the disclosure on 25 September 2026 after the issue was reported on 22 September and fixed in Elementor 4.3.2 on 24 September.
Elementor 4.3.0 introduced an Editor Events component that needed to recognize requests for its own REST route. According to Patchstack’s technical analysis, versions 4.3.0 and 4.3.1 made that decision by searching the raw request URI for a route string. Because the query string is controlled by the requester, an attacker could place the expected text in an unrelated REST request and cause WordPress nonce verification to be treated as successful.
The corrected 4.3.2 release validates the resolved REST route instead. Elementor’s public changelog describes the release as improving code-security enforcement in data handling, alongside compatibility and editor fixes.
| Question | Answer |
|---|---|
| Vulnerability | CVE-2026-62062 |
| Affected plugin | Elementor Website Builder (free/core plugin) |
| Affected versions | 4.3.0 and 4.3.1 only |
| Patched version | 4.3.2 |
| Type | Cross-site request forgery and REST nonce bypass |
| CVSS | 8.8 in Patchstack’s advisory |
| User interaction | Required; a logged-in user must open a crafted link |
| Confirmed active exploitation | Not confirmed in reviewed public sources at publication time |
Which Elementor sites are affected?
This flaw has an unusually narrow version window. Elementor 4.3.0 and 4.3.1 are vulnerable, while versions before 4.3.0 do not contain this specific Editor Events bug. Version 4.3.2 fixes it.
That does not mean an older Elementor installation is a safe long-term choice. Earlier releases may contain other resolved security or compatibility issues. The practical recommendation is to move to the latest compatible Elementor Core and Pro releases after a backup and a quick staging test.
Elementor has more than 10 million active installations overall. Patchstack estimated that more than two million sites were using one of the two affected releases around disclosure time. That estimate is not the same as two million compromised sites: exploitation still requires a privileged logged-in user to follow an attacker-controlled link.
Is Elementor Pro affected?
The vulnerable code is in Elementor’s free/core plugin, which Elementor Pro requires. A site using Pro can therefore be exposed when its installed Core version is 4.3.0 or 4.3.1. Keep both plugins current and compatible rather than updating one component while leaving the other far behind.
Does the visitor need a WordPress account?
The attacker does not need a WordPress account to create and send the malicious link. However, the victim who opens it must already be logged in. The actions available through the bypass are limited by that victim’s permissions, which is why an administrator click creates the highest risk.
Why can one clicked link become serious?
WordPress normally protects cookie-authenticated REST API requests with a nonce. That check helps prove that a request came from the WordPress interface rather than from a link or form prepared by another site. CVE-2026-62062 can make that protection report success for a request that merely contains Elementor’s expected route text.
The important detail is scope. The bypass happens before WordPress finishes routing the request, so it is not limited to one Elementor action. It can extend to core REST endpoints and endpoints registered by other plugins. The attacker still receives only the permissions of the logged-in victim, but an administrator can perform powerful actions, including creating users.
| Logged-in victim | Likely risk | Why |
|---|---|---|
| Administrator | Highest | Can manage users, settings and many plugin REST actions |
| Editor | High content risk | May alter or publish site content through permitted routes |
| Author or Contributor | More limited | Actions remain constrained by role capabilities |
| Logged-out visitor | This CSRF chain does not work as described | No privileged WordPress login cookie is available to carry the request |
This is a user-interaction vulnerability, not a password bypass that takes over every unpatched site automatically. Administrators should patch quickly without repeating claims of active mass exploitation that have not been verified.
How to check your Elementor version
Open WordPress Dashboard → Plugins → Installed Plugins and find Elementor. If the version is 4.3.0 or 4.3.1, update immediately. The public plugin directory listed 4.3.2 as the current release when this article was published.
WP-CLI users can check both Elementor components from the command line:
wp plugin get elementor --fields=name,status,version,update
wp plugin get elementor-pro --fields=name,status,version,updateThe second command returns an error when Elementor Pro is not installed, which is harmless. For fleets, wp plugin list --update=available provides a quick inventory of all pending plugin updates.
How to update Elementor safely
Elementor updates can change generated CSS, editor assets and Core–Pro compatibility, so create a fresh database and files backup first. Elementor’s own update guide recommends keeping Core and Pro current and warns that mismatched versions can break a site.
- Record the installed Elementor Core and Pro versions.
- Create a verified backup or hosting restore point.
- Test the current matching releases on staging when available.
- Update Elementor Pro as recommended by Elementor, then update Core to 4.3.2 or newer.
- Clear page, object and CDN caches.
- Open several Elementor-built pages on desktop and mobile.
- Edit and save a test page, then verify forms, popups and dynamic content.
For the free plugin, WP-CLI can perform and verify the update:
wp plugin update elementor
wp plugin get elementor --field=versionIf the update creates a compatibility issue, avoid rolling back to 4.3.0 or 4.3.1 because that restores the vulnerability. Resolve the Core–Pro mismatch or contact the vendor or host for a supported secure combination.
What if you cannot update today?
Log out of administrator sessions when they are not in use, avoid opening unsolicited links while authenticated, and ask the hosting provider whether a virtual patch is available. Patchstack states that it issued a mitigation rule. These steps reduce risk but do not replace the plugin update.
What should you review after updating?
No active exploitation was confirmed in the sources used for this article, so a full breach response is not automatically required. A short review is still sensible on an internet-facing site that ran 4.3.0 or 4.3.1.
- Check Users for unfamiliar administrator accounts.
- Review recent account creation and role changes in security or activity logs.
- Inspect unexpected content, settings or plugin configuration changes.
- Confirm that no unapproved application passwords were added.
- Verify Elementor Core and Pro versions after caches are cleared.
- If a suspicious administrator exists, preserve logs before deleting evidence and rotate credentials after containment.
This Elementor issue is different from the actively exploited WordPress core CVE-2026-87902 covered earlier. It is also separate from the s2Member remote-code-execution flaw. Sites using WordPress need to track core and plugin security independently.
Our assessment
CVE-2026-62062 deserves a fast update because it affects a widely used page builder and can turn one administrator click into a privileged REST API action. The broad REST scope makes it more serious than a CSRF bug limited to a harmless settings page.
The boundaries are equally important. Only Elementor 4.3.0 and 4.3.1 contain this specific flaw, user interaction is required, and no confirmed exploitation was found in the reviewed sources. The right response is to update to 4.3.2 or newer, verify Core–Pro compatibility and review privileged users—not to assume every Elementor site has already been compromised.
Frequently asked questions
Which Elementor versions have CVE-2026-62062?
Elementor 4.3.0 and 4.3.1 are affected. Version 4.3.2 contains the fix.
Can the flaw create a WordPress administrator?
Yes, if a logged-in administrator opens the crafted link, the bypass can authorize a REST request that creates another administrator account on a standard installation.
Does the attack work when everyone is logged out?
Not as described. The request relies on the victim’s authenticated WordPress session and permissions.
Are Elementor versions before 4.3.0 affected?
They are not affected by this specific bug, but older releases may have other vulnerabilities. Use a current supported version rather than downgrading.
Has CVE-2026-62062 been actively exploited?
No confirmed active exploitation was identified in the public sources reviewed at publication time. Administrators should still update because the mechanism is public and the potential impact is high.
Comments