A cross-site request forgery vulnerability within the Elementor plugin for WordPress allows unauthenticated attackers to provision new administrator accounts. Administrators are strongly advised to update the plugin immediately to the latest patched version to prevent full site compromise.
READ THE ORIGINAL ARTICLE AT BLEEPINGCOMPUTER.COM →