The Editor Events REST proxy in Elementor 4.3.0-4.3.1 disabled WordPress REST nonce protection for any request whose URI merely contained the events route, so an attacker could craft a link that, when opened by a logged-in administrator, performs arbitrary REST API actions on their behalf, such as creating a new administrator account. The fix validates the resolved REST route instead of the raw request URI.
This vulnerability affects the following application versions:
- Elementor Website Builder 4.3.0
- Elementor Website Builder 4.3.0-beta1
- Elementor Website Builder 4.3.0-beta2
- Elementor Website Builder 4.3.0-beta3
- Elementor Website Builder 4.3.1