The Editor Events REST proxy in Elementor 4.3.0-4.3.1 disabled WordPress REST nonce protection for any request whose URI merely contained the events route, so an attacker could craft a link that, when opened by a logged-in administrator, performs arbitrary REST API actions on their behalf, such as creating a new administrator account. The fix... Weiterlesen
Intelligence View
⚡ tsecurity.de Intelligence
Cross-Site Request Forgery in Elementor Website Builder Editor Events REST Proxy
The Editor Events REST proxy in Elementor 4.3.0-4.3.1 disabled WordPress REST nonce protection for any request whose URI merely contained the events route, so an attacker could craft a link that, when opened by a logged-in administrator,…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR