ELEMENTOR WORDPRESS FLAW LETS ATTACKERS CREATE ADMIN ACCOUNTS

Summary from the TLDR InfoSec newsletter

Security firm Patchstack warns users of the Elementor Website Builder plugin for WordPress about a new CSRF vulnerability that could allow unauthenticated attackers to create admin accounts. The vulnerability is a one-click attack that requires an authenticated admin to click a link that sends a malicious REST API request to create the account.