> TritonInfoSec News
Home / Sep 27, 2026 / Story
0
#9 The Hacker News general September 26, 2026 at 09:55 UTC

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

By [email protected] (The Hacker News)

AI Summary

A high-severity CSRF vulnerability (CVSS 8.8) in the Elementor Website Builder WordPress plugin — which has tens of millions of installs — allows unauthenticated attackers to create rogue administrator accounts if an existing admin clicks a crafted link. No CVE has been assigned yet, and admins should verify plugin versions and apply available patches immediately.

Read full article → https://thehackernews.com/2026/09/elementor-csrf-f…

Relevance score: 76.0/100

# More from September 27

  1. 1
    Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells The Hacker News
  2. 2
    ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks BleepingComputer
  3. 3
    SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild The Hacker News
  4. 4
    Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack The Hacker News
  5. 5
    Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise The Hacker News
  6. 6
    Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies CyberScoop
  7. 7
    CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks BleepingComputer
  8. 8
    Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials The Hacker News
  9. 10
    Roundcube Webmail Vulnerability in Attackers’ Crosshairs SecurityWeek