abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  CVE-2026-62062

CVE-2026-62062

Elementor Website Builder 4.3.1 - Elementor

I am @abraxas_null. Loopback lab. The client is CVE-2026-62062-Abraxas-Labs.py.

CSRF via a substring. Elementor 4.3.0-4.3.1 skips WordPress REST cookie nonce validation when REQUEST_URI contains elementor/v1/events/. is_own_route_request is strpos. Trick an administrator cookie session into POSTing /wp/v2/users with that substring and no X-WP-Nonce. 4.3.2 uses a rest_route prefix instead of raw REQUEST_URI.

CVE	CVE-2026-62062 · CVE.org
CWE	CWE-352
CVSS	High: 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Product	Elementor Website Builder
Affected	all versions through 4.3.1 (inclusive)
Patched	4.3.2 and later
Auth	unauthenticated
License	GNU Affero GPL v3.0
Lab	127.0.0.1 only

---

What an attacker can do

UI:R. Victim admin visits a URL (or their browser sends the POST). Attacker creates an administrator. Control POST without the URI substring is rest_cookie_invalid_nonce. Lab witness is 201 JSON roles: administrator, not a reverse shell.

---

How I found it

I mapped Events_Proxy_REST_API.bypass_nonce_check_for_own_routes on rest_authentication_errors, then is_own_route_request. Lab POSTs with admin cookies and no nonce.

Fail-controls already in the lab: 401 rest_cookie_invalid_nonce on the attack URL is a miss; a user created without the URI bypass is a miss; a reverse shell is not this CVE.

---

The lab

Port 18094. Elementor 4.3.0 or 4.3.1. Administrator cookie session.

• lab/Dockerfile
• lab/docker-compose.yml
• lab/run.sh

Target only 127.0.0.1:18094 (or the loopback you bound).

cd lab
docker compose up --force-recreate
python3 ../CVE-2026-62062-Abraxas-Labs.py

Witness: POST with admin cookies and no nonce: 401 without the URI substring; 201 administrator user with x=elementor/v1/events/.

Ways to lose without learning anything:

• 401 rest_cookie_invalid_nonce on the attack URL
• user created without the URI bypass
• reverse shell

---

The fix

Update Elementor Website Builder to 4.3.2 or newer. Re-run CVE-2026-62062-Abraxas-Labs.py against the patched build: the 201 administrator must not appear.

---

References

• CVE-2026-62062 · NVD

• CVE-2026-62062 · CVE.org

• www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-website-builder-430-431-cross-site-request-forgery-via-rest-nonce-bypass-to-privilege-escalation

• patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability

• www.cve.org/CVERecord?id=CVE-2026-62062

• patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

• Plugin directory: elementor

• Trac browser: plugins.trac.wordpress.org/elementor

• SVN tags: plugins.svn.wordpress.org/elementor

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

---

License

GNU Affero GPL v3.0. See LICENSE.

---

The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null