CVE-2026-62062: WordPress Elementor, CSRF to administrator
Elementor skips the REST cookie nonce when REQUEST_URI contains elementor/v1/events/. A logged-in administrator browser can be sent to create a user. The control POST without that substring is rejected.
- Name
- CVE-2026-62062: WordPress Elementor, CSRF to administrator
- Type
- N-day analysis
- CVE
- CVE-2026-62062
- CVE Risk
- high
- Disclosure Status
- public
- Vendor
- Elementor
- Affected
- WordPress plugin Elementor 4.3.0 through 4.3.1. Patched in 4.3.2.
- Published
- 28 Oct 2026
- Updated
- 28 Oct 2026
- Tags
- n-day, wordpress, elementor, csrf, cwe-352
WordPress Elementor, CSRF to administrator
Elementor Website Builder 4.3.1 - Elementor
I am @abraxas_null. Loopback lab. The client is CVE-2026-62062-Abraxas-Labs.py.
CSRF via a substring. Elementor 4.3.0-4.3.1 skips WordPress REST cookie nonce validation when REQUEST_URI contains elementor/v1/events/. is_own_route_request is strpos. Trick an administrator cookie session into POSTing /wp/v2/users with that substring and no X-WP-Nonce. 4.3.2 uses a rest_route prefix instead of raw REQUEST_URI.
CVE-2026-62062 (NVD). CWE-352. Vendor: Elementor. WordPress plugin Elementor 4.3.0 through 4.3.1. Patched in 4.3.2.
What an attacker can do
UI:R. Victim admin visits a URL (or their browser sends the POST). Attacker creates an administrator. Control POST without the URI substring is rest_cookie_invalid_nonce. Lab witness is 201 JSON roles: administrator, not a reverse shell.
How this showed up in the lab
I mapped Events_Proxy_REST_API.bypass_nonce_check_for_own_routes on rest_authentication_errors, then is_own_route_request. Lab POSTs with admin cookies and no nonce.
Fail-controls already in the lab: 401 rest_cookie_invalid_nonce on the attack URL is a miss; a user created without the URI bypass is a miss; a reverse shell is not this CVE.
The lab
Port 18094. Elementor 4.3.0 or 4.3.1. Administrator cookie session.
Target only 127.0.0.1:18094 (or the loopback you bound).
cd lab
docker compose up --force-recreate
python3 ../CVE-2026-62062-Abraxas-Labs.pyWitness: POST with admin cookies and no nonce: 401 without the URI substring; 201 administrator user with x=elementor/v1/events/.