# CVE-2026-62062: Elementor Website Builder cross-site request forgery vulnerability

Source: https://junglewise.ai/threats/cve-2026-62062-cross-site-request-forgery-csrf-vulnerability-in-elementor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-62062 · Severity: high · CVSS 8.8 · Published 2026-09-25

Elementor Website Builder is a drag-and-drop page builder plugin for WordPress that allows administrators to design and manage website content. A cross-site request forgery (CSRF) vulnerability allows attackers to trick logged-in administrators into performing unintended actions, such as modifying site settings or making unauthorized changes. Exploitation requires a user to click a malicious link or visit a crafted page while authenticated to the site.

Technologies: [Elementor Website Builder](https://junglewise.ai/threats/technologies/elementor-website-builder). Vendors: [Elementor](https://junglewise.ai/threats/vendors/elementor).

## Quick answers

**Is CVE-2026-62062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62062 being exploited in the wild.

**How severe is CVE-2026-62062?** High severity, with a CVSS score of 8.8, published 25 September 2026.

**Which products and versions are affected?** Elementor Website Builder 4.3.0 through 4.3.1.

**Is there a fix for CVE-2026-62062?** A patch was published on 2026-09-25: Patched in version 4.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62062 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62062?** Check whether you run Elementor Website Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw affecting Elementor Website Builder versions 4.3.0 through 4.3.1. It requires user interaction (clicking a link or visiting a page) and affects authenticated users. Successful exploitation allows an attacker to force a logged-in admin to execute unintended actions within the plugin's functionality. The issue has been patched in version 4.3.2.

## Affected products

- Elementor Elementor Website Builder 4.3.0 through 4.3.1

## Timeline

- 2026-09-25: disclosed: Vulnerability published by Patchstack
- 2026-09-25: patched: Patched in version 4.3.2

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)

## Related threats

- [Elementor Website Builder stored XSS in element identifier](https://junglewise.ai/threats/cve-2026-104718-the-elementor-website-builder-wordpress-plugin-before-4-3-6-does)
- [Elementor Website Builder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-120850-improper-neutralization-of-input-during-web-page-generation)
- [Elementor Website Builder reflected XSS vulnerability](https://junglewise.ai/threats/cve-2026-109884-improper-neutralization-of-input-during-web-page-generation)
- [Elementor Website Builder cross-site scripting in page generation](https://junglewise.ai/threats/cve-2026-109883-improper-neutralization-of-input-during-web-page-generation)
- [Elementor Website Builder stored XSS in SVG CDATA](https://junglewise.ai/threats/cve-2026-81813-the-elementor-website-builder-wordpress-plugin-before-4-3-5-does)