🤖 Elementor (WordPress, active on 10M+ sites): CSRF flaw CVSS 8.8, no CVE ID yet. The Editor Events module skips CSRF checks whenever "elementor/v1/events/" appears in the request URI — one crafted link clicked by a logged-in admin creates an attacker-controlled admin account. Affects 4.3.0/4.3.1, fixed in 4.3.2. 🔗 https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html #CVE #WordPress #Exploit #CyberSec