Elementor security alert
Elementor 4.3.0 and 4.3.1 are affected by a flaw in the Editor Events module that can bypass WordPress REST API nonce validation and potentially let a logged-in administrator be tricked into creating a new attacker-controlled admin account.
Businesses using Elementor should check their installed version and update promptly if affected. Elementor 4.3.2 contains the security fix, so sites running 4.3.0 or 4.3.1 should move to the patched release after taking a backup and checking compatibility.
What is the Elementor security vulnerability?
The issue is a cross-site request forgery (CSRF) vulnerability. In practical terms, an attacker could send a specially crafted link to someone who is already logged into WordPress with administrator privileges.
If that administrator opens the malicious link while authenticated, the existing WordPress session could potentially be abused to perform an action the administrator did not intend. Researchers reported that, on a standard installation, this can include creating a new WordPress administrator account controlled by the attacker.
Administrator access is serious because it can provide extensive control over a website, including the ability to install plugins, alter themes, create users, change settings, modify content and access WooCommerce administration.
Which Elementor versions are affected?
The affected releases are:
- Elementor 4.3.0
- Elementor 4.3.1
Elementor 4.3.2 includes the fix. Running an affected version does not automatically mean a website has been compromised, but it does mean the vulnerable condition is present and should be dealt with promptly.
What to do now
Take a current backup, update Elementor to 4.3.2 or later, clear caches, test key pages and review WordPress administrator accounts for anything unfamiliar.
Should I update Elementor now?
If your website is running Elementor 4.3.0 or 4.3.1, the update should be treated as a priority. For a business-critical website, the safest process is controlled rather than simply pressing every update button at once.
- Take a complete backup of the website and database.
- Confirm the backup is usable.
- Check whether Elementor Pro also needs an update.
- Update Elementor to 4.3.2 or later.
- Clear website, server and CDN caches.
- Test important pages on desktop and mobile.
- Test contact forms and navigation.
- Test WooCommerce checkout if the site sells online.
- Review WordPress administrator accounts.
If you do not want to test a security update directly on the live site, use a staging copy first. Core Web UK’s website maintenance service covers controlled updates, backups and ongoing technical checks for business websites.
Check your WordPress administrator accounts
Updating removes the vulnerable code, but businesses should also check whether anything suspicious has already happened.
In WordPress, go to Dashboard → Users → All Users and review every account with the Administrator role. Look for usernames you do not recognise, recently created administrator accounts, unfamiliar email addresses or unexpected changes to legitimate users.
An unknown administrator account should be investigated immediately. Simply deleting it may not be enough if other changes were made while privileged access was available.
Why this matters for business websites
Elementor often controls much more than a website’s appearance. It can sit behind landing pages, forms, templates, headers, footers, WooCommerce layouts and important parts of the customer journey.
A compromised administrator account can therefore affect website availability, customer enquiries, checkout functionality, website content, stored data and business reputation.
This is also why leaving a WordPress website untouched simply because it still looks normal is risky. Security problems can remain invisible while the front end continues to load as usual.
What if the Elementor update breaks the website?
Some businesses delay plugin updates because they are worried about layout changes or compatibility problems. That concern is reasonable, particularly where Elementor interacts with caching, optimisation plugins, third-party add-ons, custom CSS or older PHP versions.
The safer answer is not to leave a known vulnerability unpatched. Take a backup, test carefully and make sure there is a recovery path available.
If an update causes a white screen, broken styling, PHP errors or prevents pages from publishing, our Elementor publishing troubleshooting guide explains what to check. If the problem turns out to be an extension clash, the WordPress plugin conflict diagnostic process is the relevant next step.
Has my Elementor website already been compromised?
Being on an affected version is not proof of compromise. If you are concerned, useful checks include reviewing administrator accounts, recently installed plugins, unexpected theme or plugin changes, security logs, unfamiliar scheduled tasks and unexplained redirects or injected pages.
Evidence of unauthorised administrator access should be treated as a possible security incident rather than an ordinary update problem.
What Elementor users should do today
Check the installed Elementor version. If it is 4.3.0 or 4.3.1, take a suitable backup and update to 4.3.2 or later, then test the website and review administrator accounts.
If you are unsure whether an update is safe or something has already changed unexpectedly, Core Web UK can help with WordPress maintenance and support before the issue develops into a larger recovery job.
