CVE-2026-62062

{
  "etk_id": "ETK-2026-201",
  "cve_id": "CVE-2026-62062",
  "display_id": "CVE-2026-62062",
  "ghsa_id": "GHSA-f746-2pfg-cwp9",
  "euvd_id": "EUVD-2026-86532",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site request forgery in Elementor Website Builder",
  "summary": "Elementor Website Builder versions through 4.3.1 are affected by a cross-site request forgery weakness. An attacker may be able to cause a logged-in user's browser to send unintended requests; this requires interaction by a user with an active authenticated session.",
  "mitigation": "Apply the vendor's remediation for versions through 4.3.1 when it is available. Until then, restrict administrative access, require strong administrator authentication, and advise administrators not to follow untrusted links while signed in.",
  "vendor": "elementor",
  "product": "Website Builder",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 4.3.1"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "elementor",
      "purl": null
    }
  ],
  "cwes": [
    352
  ],
  "cvss_score": 8.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": 0.0013,
  "epss_percentile": 0.0239,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.645162966666668,
  "t0_at": "2026-09-25T06:29:47.521000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T04:05:25.471543+00:00",
      "days": 5.899744797951389,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:29:47.521000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-25T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:29:47.521000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-62062"
    },
    "public_poc": {
      "at": "2026-09-25T21:35:51+00:00",
      "days": 0.6292069328703703,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:29:47.521000+00:00",
      "url": "https://github.com/abraxas/CVE-2026-62062"
    },
    "trigger_signal": {
      "at": "2026-09-25T00:00:00+00:00",
      "days": -0.27068890046296296,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:29:47.521000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-62062"
    }
  }
}