Patchstack has demonstrated how one crafted link can make a logged-in WordPress administrator create an attacker-controlled admin account. The affected Elementor Website Builder releases are 4.3.0 and 4.3.1; version 4.3.2 fixes the issue.

The vulnerability record identifies CVE-2026-62062 as a CVSS 8.8 cross-site request forgery flaw. The attacker needs no site account, but the victim must already be logged in with sufficient permissions.

The technical analysis describes a check that trusts the string elementor/v1/events/ anywhere in a request URI. An attacker-controlled query can therefore bypass the normal REST nonce check. Other authorised REST routes are in scope, not only Elementor routes. The hidden component defaults on for sites first installed with Elementor 3.32.0 or later. The reviewed disclosure does not confirm malicious exploitation.

For a site owner, the important distinction is between closing the request path and removing changes already made through it. Updating a plugin does not itself explain who created each administrator, whether credentials were changed or which settings were altered. Record those questions in the incident review instead of treating a successful update screen as proof that the site is clean.

Agencies managing many customer sites should verify the installed release on each site and assign responsibility for account review. A shared maintenance account can otherwise obscure which person was browsing when a suspicious request occurred.

BlackTree previously covered a separate Elementor Pro file-upload vulnerability. That issue and CVE-2026-62062 are not the same flaw. The new lesson is about shared authentication hooks: code intended to exempt one plugin route…