One Link Can Borrow Your Administrator’s Authority
A forged WordPress link exploiting CVE-2026-62062 can create an attacker-controlled administrator. The attacker needs no login; the signed-in victim needs permission.
Elementor 4.3.0 and 4.3.1 are affected; 4.3.2 is fixed. The assigned rating is CVSS 3.1/8.8. Although the CNA record broadly lists through 4.3.1, research limits exposure to this pair.
One exception, every route
Research finds an attacker-supplied query containing elementor/v1/events/ fools a whole-address substring test before routing. It skips the request token proving intent, not the victim’s permissions. A link’s navigation can become a write against every available REST endpoint, other plugins included. The hidden telemetry proxy defaults on for first installations from 3.32.0; earlier releases lack it.
Exploitation labels are not a victim count
The database entry labels it known exploited, without naming actors, victims, campaigns, attack dates or request evidence. The linked BlackTree catalogue records neither CISA nor ENISA confirmation; the EUVD retrieval displayed there is dated 28 September. These are source-specific observations, not proof that attacks never occurred or that an individual site was breached.
An upgrade does not remove an extra administrator
WordPress recovery guidance supports documenting symptoms and times, preserving a snapshot before cleaning, reviewing users and resetting access. Applying that guidance here:
- Install the corrected release and verify the resulting version on production, staging and dormant sites. Agencies should assign account-review responsibility per site, not rely on an update screen.
- Investigate unexpected administrators created during the vulnerable period. Check creation times, email addresses, permission changes, altered credentials and settings. Shared maintenance accounts can obscure who was browsing.
- Hunt the marker in web/application query logs for user, settings and plugin routes, connected plugins included.
- Preserve evidence before rotating affected credentials, invalidating suspicious sessions and changing authentication salts. Use dedicated accounts or browser profiles for administration, separate from routine email and browsing.
Our earlier Elementor Pro upload report concerns a different flaw. Patching and investigating durable access are separate tasks.
Sources and chronology
Rechecked 22 October 2026. Research/database: 25 September, time unstated; the fix preceded publication by one day. The catalogue’s missing confirmation must not be treated as a current worldwide exploitation survey.
