Elementor WordPress CSRF Flaw Enables Unauthenticated Admin Account Creation — Detection and Remediation Guide

---
title: Suspicious Elementor AJAX Activity on WordPress
description: Detects POST requests to WordPress admin-ajax.php containing Elementor action parameters, indicative of attempts to interact with Elementor plugin endpoints. Elevated scrutiny is warranted where requests originate from sources with no authenticated session context, consistent with CSRF exploitation targeting account creation.
author: Security Arsenal
id: 4b7e2c91-3d8a-4f5e-9a1c-6e2d8f0b3a54
status: experimental
date: 2026/01/15
references:
  - https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/
  - https://attack.mitre.org/techniques/T1190/
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/wp-admin/admin-ajax.php'
    cs-uri-query|contains:
      - 'elementor'
      - 'action=elementor'
  condition: selection
falsepositives:
  - Legitimate Elementor editor activity by authenticated site administrators
  - Tune by correlating with authenticated session cookies and known admin source IPs
level: high
---
title: WordPress User Creation or Login Endpoint Abuse
description: Detects request patterns consistent with forged user registration and subsequent attacker login on WordPress, including registration endpoint access and wp-login.php POSTs from sources that recently issued admin-ajax Elementor requests.
author: Security Arsenal
id: 8f3a1d62-7c4e-4b9a-a2d5-1e9c4f7b8d21
status: experimental
date: 2026/01/15
references:
  - https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/
  - https://attack.mitre.org/techniques/T1136/
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection_registration:
    cs-uri-stem|contains:
      - '/wp-login.php'
      - '/wp-json/wp/v2/users'
    cs-uri-query|contains:
      - 'action=register'
      - 'action=createuser'
  selection_login:
    cs-method: 'POST'
    cs-uri-stem|contains: '/wp-login.php'
  condition: selection_registration or selection_login
falsepositives:
  - Legitimate administrator logins and user management
  - Membership/e-commerce plugins that register users via wp-login.php; baseline per-site and alert on deviation
level: medium

// Hunt for Elementor admin-ajax POST activity correlated with subsequent wp-login success patterns
// Works with CommonSecurityLog (WAF/CEF ingestion), Syslog-ingested web logs, or W3CIISLog
let elementorAjax =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL has "admin-ajax.php" and RequestURL has "elementor"
    | where RequestMethod == "POST"
    | summarize AjaxHits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL;
let suspiciousLogins =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL has "wp-login.php" and RequestMethod == "POST"
    | summarize LoginPosts = count() by SourceIP, DestinationHostName;
elementorAjax
| join kind=inner suspiciousLogins on SourceIP
| project SourceIP, DestinationHostName, RequestURL, AjaxHits, LoginPosts, FirstSeen, LastSeen
| order by AjaxHits desc
;
// Secondary hunt: REST API user creation attempts against /wp-json/wp/v2/users
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has "/wp-json/wp/v2/users" and RequestMethod == "POST"
| summarize Attempts = count(), make_set(RequestURL) by SourceIP, DestinationHostName, TimeGenerated
| order by TimeGenerated desc

-- Artifact: Hunt.WordPress.ElementorCSRF
-- Parses Apache/Nginx access logs for Elementor admin-ajax POSTs and user-creation indicators,
-- and enumerates the installed Elementor version for exposure triage.

-- 1) Suspicious web requests targeting admin-ajax.php with Elementor actions
SELECT FullPath AS LogFile, Line, parse_string_with_regex(string=Line,
    regex='(?P<src>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\d{1,3})').src AS SourceIP
FROM parse_lines(filename="/var/log/apache2/access.log")
WHERE Line =~ "admin-ajax.php" AND Line =~ "elementor" AND Line =~ "POST"

-- 2) Registration and user-creation endpoint hits
SELECT FullPath AS LogFile, Line
FROM parse_lines(filename="/var/log/apache2/access.log")
WHERE Line =~ "action=register"
   OR Line =~ "action=createuser"
   OR Line =~ "/wp-json/wp/v2/users"

-- 3) Installed Elementor version disclosure (readme.txt fingerprint)
SELECT FullPath, Data.Version AS ElementorVersion, Mtime
FROM glob(globs="/var/www/**/wp-content/plugins/elementor/readme.txt")
LIMIT 100

#!/bin/bash
# WordPress / Elementor CSRF exposure triage and hardening script
# Run on the hosting server with WP-CLI installed (or adapt paths as needed)

WP_PATH="/var/www/html"

# 1) Identify installed Elementor version
echo "=== Elementor version ==="
wp --path="$WP_PATH" plugin get elementor --field=version 2>/dev/null || \
  grep -m1 "Stable tag" "$WP_PATH"/wp-content/plugins/elementor/readme.txt 2>/dev/null

# 2) Update Elementor (and all plugins) to latest patched release
echo "=== Updating Elementor ==="
wp --path="$WP_PATH" plugin update elementor

# 3) Audit for rogue administrator accounts — flag anything you do not recognize
echo "=== Administrator accounts ==="
wp --path="$WP_PATH" user list --role=administrator --fields=user_login,user_email,user_registered

# 4) Show accounts registered in the last 30 days for closer review
echo "=== Recently registered users ==="
wp --path="$WP_PATH" user list --fields=user_login,user_email,user_registered,roles | \
  awk -v cutoff="$(date -d '30 days ago' +%Y-%m-%d)" '$3 >= cutoff'

# 5) Grep access logs for exploitation indicators
echo "=== Suspicious admin-ajax / Elementor POSTs ==="
grep -h "admin-ajax.php" /var/log/apache2/*access*.log /var/log/nginx/*access*.log 2>/dev/null | \
  grep -i "elementor" | grep "POST" | tail -n 50

echo "=== User registration / creation endpoint hits ==="
grep -hE "action=register|action=createuser|/wp-json/wp/v2/users" \
  /var/log/apache2/*access*.log /var/log/nginx/*access*.log 2>/dev/null | tail -n 50

# 6) Check for unexpected files in uploads (webshell triage)
echo "=== PHP files in uploads directory (should be near-zero) ==="
find "$WP_PATH"/wp-content/uploads -name "*.php" -mtime -60 2>/dev/null

echo "Done. Any unrecognized admin account = treat as compromised: remove account, reset all credentials, rotate salts/keys in wp-config.php, and perform a full malware scan."