All it takes to hand a stranger the keys to your WordPress site is one click on a link that looks like literally nothing — a support reply, an invoice, a blog comment. That's the entire attack surface of the latest Elementor bug, and if "one click" sounds like a low bar, that's because it is.

A REST Route With a Very Bad Memory

Security researchers disclosed CVE-2026-62062, a cross-site request forgery flaw in Elementor Website Builder versions 4.3.0 and 4.3.1, carrying a CVSS score of 8.8 out of 10. A flawed REST route check means that when a logged-in user — ideally an administrator — clicks a maliciously crafted link, their browser quietly performs whatever REST API action the attacker packaged into it.

On a default install, that action is "create a new administrator account." No password prompt, no confirmation dialog, just a plain-text hyperlink doing its dirty work in the background the moment it's opened.

Ten Million Reasons to Check Your Version Number

Elementor runs on more than 10 million WordPress sites, and the two vulnerable versions alone account for over 2 million of them — which is a lot of "Get a Quote" pages one careless click away from a hostile takeover. Elementor patched the flaw in version 4.3.2.

The part that should really bug you: this isn't some exotic zero-click exploit requiring elite hacking skills. It's social engineering 101 wrapped around a technical flaw, which means the fix is as much "train your team not to click weird links" as it is "update your plugin."

If your site's security depends on nobody on your team ever clicking a suspicious link, you don't have a security plan — you have a hope.

Patch management shouldn't be a once-a-year fire drill — grab our free developer's security checklist and get ahead of the next one-click disaster.

Source: The Hacker News