CVE-2026-62062
Received Received - Intake

Cross-Site Request Forgery in Elementor Website Builder

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Patchstack

Description
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-62062
EUVD
EUVD-2026-86532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elementor website_builder to 4.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the Elementor Website Builder plugin for WordPress. It allows attackers to trick logged-in users into performing unintended actions, such as changing passwords or making purchases, by exploiting malicious links or crafted pages. The vulnerability requires user interaction, like clicking a link or submitting a form.

Detection Guidance

Detecting this CSRF vulnerability typically involves checking the Elementor Website Builder plugin version on your WordPress site. Log in to your WordPress admin panel, go to Plugins, and verify if the Elementor version is 4.3.1 or lower. If so, the site is vulnerable. You can also use security plugins or tools like WPScan to scan for vulnerable versions.

Impact Analysis

An attacker could exploit this to perform actions on your behalf without your consent, such as modifying account settings, making unauthorized purchases, or changing passwords. This could lead to data loss, financial damage, or unauthorized access to your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized data changes or access, potentially violating GDPR (data protection) or HIPAA (health data privacy) by exposing or altering sensitive user information. Compliance may be compromised if user data is improperly modified or accessed.

Mitigation Strategies

Immediately update the Elementor Website Builder plugin to version 4.3.2 or later. If updating is not possible right away, apply the mitigation rule provided by Patchstack to block attacks until the update is applied. Remove any unnecessary user accounts with elevated privileges to reduce attack surfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart