Filtered by category: Hacker News, tag: plugin × Clear
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Matched: WordPress
A high-severity CSRF flaw in the Elementor WordPress plugin (CVSS 8.8) allows unauthenticated attackers to create rogue admin accounts and take over sites if an administrator clicks a crafted link. No CVE has been assigned yet. Site owners should update the plugin immediately to protect against exploitation.