MEDIUMVulnerability
Global

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

·Source: The Hacker News

Updated:

Executive Summary

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions

Analysis

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions
Source Attribution

Originally published by The Hacker News on Sep 26, 2026.

Related Threats

MEDIUMVulnerability

Metamask discloses security incident affecting its infrastructure

On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2025-41753 — The object name of a dynamically created BACnet File Object is interpreted as a ...

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

CVE-2025-41753
NIST NVD
MEDIUMVulnerabilityPOC

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path

Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working

CVE-2026-86950
The Hacker News