Elementor’s CVE-2026-62062: What WordPress Site Owners Need to Know

CVE-2026-62062 is a cross-site request forgery (CSRF) vulnerability in Elementor Website Builder for WordPress. It can let an unauthenticated attacker use a crafted link to make a logged-in administrator’s browser perform an action on the site, including creating an attacker-controlled administrator account. Elementor 4.3.0 and 4.3.1 are identified as affected; version 4.3.2 is listed as patched. 2323

How the attack works

The attacker does not need an account on the target site. The attack depends on a site administrator already being logged in and opening the link. The browser then sends a REST API request using that administrator’s existing session and permissions. Patchstack says the link can be a plain anchor shared through email, chat, or a comment; it does not require JavaScript or an attacker-controlled page. On a stock installation, the resulting action can create another administrator account. 2

This is CSRF: the attacker tricks an authenticated user’s browser into making a request the user is authorized to make. It is not a case of the attacker independently logging in as an administrator.

Affected versions and what is known about the routes

Security reporting identifies Elementor Website Builder versions 4.3.0 and 4.3.1 as affected, with the issue fixed in 4.3.2. CVE listings describe the affected range more broadly as versions through 4.3.1. 2323

The reports describe the flaw as a bypass of WordPress REST API nonce validation. Secondary write-ups point to a URI check involving the string elementor/v1/events/, but the available reporting does not establish a verified, complete list of affected REST API route names. 1719

Severity, disclosure, and patch timeline

CVE-2026-62062 is rated 8.8 (High) in the CVE listing. 34 BleepingComputer reports that Patchstack notified Elementor on September 22, 2026; the CVE listing was published on September 25, 2026. A secondary report dates the release of version 4.3.2 to September 24, while Patchstack and WPScan identify 4.3.2 as the patched version. 18222326

What site owners should do

1. Update Elementor to version 4.3.2 or later. Patchstack lists 4.3.2 as the patched version. 23
2. Review administrator accounts and investigate any account you do not recognize, given that the reported impact includes creating a new administrator. 2
3. If you cannot update immediately, check whether Patchstack’s mitigation rule is available to you. Patchstack says it issued mitigation rules, but describes updating as the action to resolve the vulnerability. 223

Is the flaw being exploited in the wild?

A proof of concept is reported in vulnerability-tracking sources, but the available evidence reviewed here does not confirm real-world exploitation. Feedly’s CVE entry reports no exploitation, and CyStack’s listing shows no known exploited-vulnerability entry for the issue. A published proof of concept should not be treated as proof that a site has been attacked. 81113