Cross-Site Request Forgery Vulnerability in Elementor Website Builder by Elementor
CVE-2026-62062

8.8HIGH

Key Information:

Vendor

WordPress
Status
Elementor Website Builder
Vendor
CVE Published:
25 September 2026

What is CVE-2026-62062?

A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in Elementor Website Builder, which could allow an attacker to perform unauthorized actions on behalf of a user without their consent. This flaw potentially affects versions from n/a through 4.3.1, making it crucial for users to update their software to mitigate risks. Attackers exploiting this vulnerability could manipulate users into executing unwanted actions, leading to further security breaches. Users are advised to ensure they are running the latest version of the Elementor plugin to protect their websites.

Affected Version(s)

Elementor Website Builder <= 4.3.1

References

https://patchstack.com/database/wordpress/plugin/elemento...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saggre | Patchstack Bug Bounty Program
.