{"vulnerability": "cve-2026-62062", "sightings": [{"uuid": "e15f4b0d-2282-40d9-bd31-8cd61ee94b1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwda5gyn7324", "content": "\ud83d\udfe0 CVE-2026-62062 - High (8.8)\n\nCross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Re...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-62062/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T07:18:46.048303Z"}, {"uuid": "aef394d4-b604-4a27-8eea-f6a59ed8a788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/54iu4zbg2pflt", "content": "CVE-2026-62062 - WordPress Elementor Website Builder plugin\nCVE ID : CVE-2026-62062\n \n Published : Sept. 25, 2026, 6:29 a.m. | 29\u00a0minutes ago\n \n Description : Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.\n\nThis ...", "creation_timestamp": "2026-09-25T08:24:06.918665Z"}, {"uuid": "385b238f-303e-4c62-80b3-d93c3923d7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103376", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-62062\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a abraxas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 21:36:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-62062 - WordPress - Elementor Website Builder - High 8.8 - Unauthenticated POST /?rest_route=/wp/v2/users&x=elementor... - Cross-Site Request Forgery to Administrator Account Creation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T22:00:09.000000Z"}, {"uuid": "d9b2a465-b650-40e6-9313-3dd68fce7269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "published-proof-of-concept", "source": "Telegram/VCxCWyiIftc3zqyXq_-idMYYXJu_pWk2hZoed5IyUk8wBzA", "content": "", "creation_timestamp": "2026-09-26T03:00:15.000000Z"}, {"uuid": "d5d413fb-11f5-4eea-aae4-7be80fc44ad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mwg76uucow2z", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-97622\n\nRejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-62062. Reason: This candidate is a reservation duplicate of CV...", "creation_timestamp": "2026-09-26T11:39:38.739801Z"}, {"uuid": "bb163d0b-9324-4ac0-922a-e42d6238bff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-62062", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwgueocfju2i", "content": "Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Full\u00a0Takeover\n\nElementor CVE-2026-62062 is a CVSS 8.8 CSRF flaw affecting versions 4.3.0 and 4.3.1. Update to 4.3.2 to block the attack...\n\nhttps://thecybersecguru.com/news/elementor-cve-2026-62062-csrf-vulnerability/", "creation_timestamp": "2026-09-26T17:58:42.760161Z"}, {"uuid": "50bd6907-00b8-440d-99fb-1c40cb921981", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwjzjnnbhc2n", "content": "WordPress \u30d7\u30e9\u30b0\u30a4\u30f3\u300cElementor\u300d\u306b\u5371\u967a\u5ea6\u306e\u9ad8\u3044\u8106\u5f31\u6027 CVE-2026-62062-4.3.2\u3067\u4fee\u6b63 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "creation_timestamp": "2026-09-28T00:08:58.882127Z"}, {"uuid": "ee245cb8-fffc-44ae-9d18-b374aaceb40f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwlft46qsn2u", "content": "Discover the critical CVE-2026-62062 Elementor CSRF vulnerability. Learn how this REST API bypass threatens millions of WordPress sites and how to patch it.\n\n#Elementor #WordPress #CSRF #CyberSecurity #WebSecurity", "creation_timestamp": "2026-09-28T13:21:38.987898Z"}, {"uuid": "8cef9a66-37a3-4a5d-9c81-94e9ce3aa659", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62062", "type": "seen", "source": "https://t.me/baseleeak/405", "content": "Dangerous Flaw Discovered in Elementor: Simple URL Click Grants Superuser Privileges\nA simple link can turn an active WordPress administrator session into a site takeover tool. A newly discovered vulnerability in the Elementor Website Builder allows attackers to bypass REST API Cross-Site Request Forgery (CSRF) protection and execute actions with the privileges of an authenticated user, including creating a new administrator account.\nThe vulnerability, tracked as CVE-2026-62062, received a CVSS 3.1 score of 8.8. It affects Elementor versions 4.3.0 and 4.3.1. Patchstack disclosed the flaw on September 25 following a report by a security researcher known as Saggre. While Elementor is installed on over 10 million sites, the potential blast radius for the vulnerable versions is estimated at around 2 million installations.\nThe flaw resides in the Editor Events module, which handles editor telemetry. The code attempts to identify requests directed to Elementor\u2019s own route by searching for the string elementor/v1/events/. However, it checks for this string across the entire raw URI. This includes the query string, which is fully controlled by the request sender.\nAn attacker can append this specific string as a harmless parameter to a request aimed at a completely different REST route. Elementor mistakenly recognizes the request as its own and returns a successful result in the authentication filter before standard WordPress checks take place. Consequently, the core skips the REST nonce verification, which is supposed to ensure that the action was genuinely initiated by the authorized user.\nHowever, authorization checks are not completely bypassed. The REST API still verifies whether the specific action is permitted for the current user, meaning the impact depends on the victim's privileges. If the crafted URL is opened by a logged-in administrator, a request to the standard user route can create a secondary administrative account with the attacker\u2019s credentials.\nThis attack scenario requires no JavaScript, HTML forms, or an attacker-controlled website. WordPress supports the _method parameter, which can turn a standard GET request into a state-changing write operation. As a result, the entire malicious payload fits directly into a URL that can be delivered via email, direct message, or comment. The victim only needs to open the link during an active session.\nThis bypass affects more than just Elementor's routes. Because the check triggers before WordPress identifies the actual REST route, the vulnerability extends to the entire available REST API, including functions from other plugins. The actual scope of achievable actions depends on the user's permissions and installed components, with administrator creation being the most critical exploit scenario.\nThe issue specifically impacts versions 4.3.0 and 4.3.1. Older releases do not contain the vulnerable Editor Events proxy, though they may have other flaws. In early September, threat actors were already targeting Elementor Pro via a different critical vulnerability that allowed arbitrary PHP file uploads and remote code execution (RCE).\nElementor released version 4.3.2 on September 24. The patched code no longer parses the raw URI alongside its parameters; instead, it checks the pre-determined WordPress REST route and requires the Elementor namespace to be strictly at the beginning. This approach prevents attackers from injecting the required string via the query string.\nA similar class of attacks recently affected the WordPress core itself. In the Click2Shell chain, an authenticated administrator's browser also executed an unintended action after opening a crafted resource, though the underlying technical mechanism differed. As of now, there is no public evidence of active exploitation (in the wild) for CVE-2026-62062. Patchstack strongly recommends upgrading to Elementor 4.3.2 or later.", "creation_timestamp": "2026-09-28T20:02:41.000000Z"}]}