Elementor 4.3.0-4.3.1 – REST Nonce Bypass to Privilege Escalation

Elementor Website Builder versions 4.3.0 and 4.3.1 contain a high-severity REST API nonce bypass that can turn a single clicked link into an administrator account takeover. The issue is tracked as CVE-2026-62062, has a CVSS score of 8.8, and is fixed in Elementor 4.3.2.

Vulnerability summary

• Product: Elementor Website Builder
• Affected versions: 4.3.0 and 4.3.1
• Fixed version: 4.3.2
• CVE: CVE-2026-62062
• Severity: High, CVSS 8.8
• Attack class: Cross-site request forgery through REST nonce bypass
• Attacker authentication: Not required
• User interaction: A logged-in WordPress user must follow an attacker-controlled link
• Potential impact: Any REST action permitted to the victim’s role, including administrator creation when the victim is an administrator

How the bypass works

Elementor 4.3.0 and 4.3.1 added an Editor Events component that exempted its telemetry route from WordPress REST nonce validation. The component checked the raw REQUEST_URI for the string elementor/v1/events/. Because the raw URI includes attacker-controlled query parameters, that marker could be placed in a request targeting an unrelated REST endpoint.

The vulnerable callback ran early on rest_authentication_errors and returned a truthy value. WordPress interpreted that as successful authentication and skipped its normal cookie-authenticated REST nonce check. The target endpoint’s capability check still ran, but it evaluated the permissions of the logged-in victim whose browser followed the link.

The result is unusually broad: the bypass applies to WordPress core REST endpoints and endpoints registered by other plugins. An administrator victim could be induced to create another administrator, change settings, modify content, or perform other actions available through REST.

Which sites are exposed?

Only Elementor 4.3.0 and 4.3.1 contain the vulnerable code. The Editor Events experiment is hidden and was enabled by default on sites whose first Elementor installation was version 3.32.0 or later. Site owners should not assume they are safe merely because no related experiment appears in the Elementor settings screen.

Immediate remediation

1. Update Elementor to 4.3.2 or later immediately.
2. Until the update is complete, instruct administrators and editors not to follow unsolicited links while logged in to WordPress.
3. If updating cannot be completed promptly, deactivate Elementor temporarily or enforce a WAF rule that blocks requests containing elementor/v1/events/ outside the legitimate Elementor REST route.
4. After updating, purge page, object, and CDN caches and confirm the vulnerable plugin files are gone.

Verify the installed version

wp plugin get elementor --field=version
wp plugin update elementor
wp plugin get elementor --field=version

The final command should report 4.3.2 or newer. Elementor Pro users should update both the free framework and the Pro add-on, then test the editor on staging or a representative page.

Defensive log review

Search web-server and security logs for requests that contain the Elementor events-route marker on REST URLs that are not the legitimate Elementor events endpoint. This is a detection example only:

grep -Ei 'wp-json.*elementor/v1/events/' access.log*

Review matching entries for requests to user, settings, post, plugin, or third-party REST routes. A successful write response, especially HTTP 200 or 201, is more concerning than a rejected request. Also review activity occurring shortly after a suspicious request.

Compromise checks

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp plugin list --status=active
wp plugin list --status=must-use
wp cron event list
wp core verify-checksums
wp plugin verify-checksums elementor

Investigate unexpected administrator accounts, recent option changes, deleted or modified content, unfamiliar plugins, new scheduled tasks, and REST requests associated with an administrator session. If unauthorized changes are confirmed, preserve logs and a filesystem/database snapshot before cleanup, rotate administrator and hosting credentials, replace modified files from trusted packages, and revoke active sessions.

What changed in 4.3.2?

The patched release checks the resolved WordPress REST route instead of the raw request URI and requires the Elementor namespace to appear at the beginning of that route. Query-string text can no longer satisfy the route test, and the callback no longer grants a site-wide REST nonce bypass.

Sources

• Patchstack technical advisory
• Wordfence Intelligence record
• Elementor on WordPress.org
• CVE-2026-62062

This article summarizes public research by Patchstack and Wordfence and provides defensive remediation guidance. WPDeeply did not discover this vulnerability.