Elementor fixes WordPress flaw that could let attackers create admin accounts

Elementor has released version 4.3.2 of its WordPress plugin to fix a flaw that could let an attacker create an administrator account. The attack requires a logged-in administrator to open a malicious link. That action can make the administrator's session send an authorized request to the site. The flaw affects versions 4.3.0 and 4.3.1, which WordPress.org statistics indicate are used by up to 2 million sites. Security firm Patchstack says the plugin could be tricked into skipping a check intended to confirm that the administrator authorized the request. Earlier versions lack the affected component but have other vulnerabilities.