AIKIDO-2026-899801

TL;DR

Events_Proxy_REST_API::bypass_nonce_check_for_own_routes treats any request URI containing elementor/v1/events/ as one of its own routes and returns authentication success before WordPress verifies the REST nonce. is_own_route_request searches the raw URI, which includes attacker-controlled query parameters, so an unauthenticated attacker can append that marker to an unrelated REST request and induce a logged-in user to execute it with their existing permissions. If an administrator opens a crafted link, the attacker can create a new administrator account and take over the site. The fix checks the resolved REST route instead of the raw URI and requires the Elementor events namespace at the start of the route.