Elementor WordPress CSRF Flaw Allows Admin Account Creation
A CSRF flaw in Elementor Website Builder versions 4.3.0 and 4.3.1 can let an attacker induce a logged-in WordPress administrator to create an attacker-controlled admin account. Version 4.3.2 fixes the issue.