A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim’s authenticated session to perform a REST API action permitted by their account.

On default installations, the result is the creation of an administrator account under the control of the attacker.

The Elementor Website Builder is a popular WordPress plugin active on 10 million websites that lets users create websites using a drag-and-drop interface.

The CSRF flaw has yet to receive an identifier and impacts only versions 4.3.0 and 4.3.1. According to statistics from WordPress.org, the two versions are used by up to 2 million sites.

Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter “Saggre.” Elementor released a fix two days later, in version 4.3.2 of the plugin.

According to Patchstack’s analysis, the CSRF flaw is caused by Elementor’s Editor Events module checking the raw request URI for the elementor/v1/events/ path and bypassing WordPress’s REST nonce validation when that string is present.

Because the URI also contains attacker-controlled query parameters, attackers can append the path to requests targeting other REST endpoints and trick logged-in users into executing them with their existing privileges.

Patchstack says the flaw can be abused in one-click attacks against a logged-in administrator to create a new attacker-controlled admin account.

“One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform,” Patchstack explains.

The security firm says that the attack does not require JavaScript, an attacker-controlled webpage, or a submitted form, and the link can be delivered to the target via email, a chat message, or a comment on the site.

Elementor releases before 4.3.0 do not contain the affected Editor Events proxy, but those older versions are vulnerable to other flaws, some of which are already actively exploited.

Users of the plugin are recommended to upgrade to Elementor version 4.3.2 as soon as possible, which prevents attackers from triggering the bypass through the query string.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Audioengine has a strong presence in the compact powered speaker category, and one of its most enduring products is the A2+ Series. Labeled as a home music system, the A2+ began as the A2 Desktop Hi-Fi system in 2007, followed by the first A2+ in 2013, which added a USB DAC. The A2+ Wireless followed in 2019 with Bluetooth connectivity, followed by the A2+ Next Gen and Anniversary Editions in 2025.

Building on the success of one of its best-known products, Audioengine has unveiled the A2+ Gen 3 for 2026 with additional improvements designed to keep it relevant in today’s market.

As with its predecessors, the A2+ Gen 3 consists of two compact powered speakers. The primary speaker (left) incorporates wireless and wired source connectivity, along with the amplification required to power both speakers. The secondary speaker (right) is passive and connects to the primary speaker using standard speaker cable.

Audioengine has been a major supporter of this type of system, with the A2 and A2+ helping inspire additional high-performance compact speaker systems such as the A5+, HD3, HD4, HD5, HD6, A1-MR, and more.

What’s New with A2+ Gen 3

The significant addition to the A2+ Gen 3 is the incorporation of Bluetooth 5.3 with Qualcomm aptX Adaptive Bluetooth, along with more refined USB compatibility.

“For years, the A2+ has been the product people recommend when someone asks how to get the highest-quality sound from a small desktop setup,” said Nate Rodriguez, President and CEO of Audioengine. “The A2+ Gen 3 keeps the size and simplicity people already know and love, but gives it broader Bluetooth support and better USB compatibility.”

aptX Adaptive is designed to dynamically adjust transmission based on the audio content and wireless environment. The system supports aptX Adaptive, aptX HD, aptX, AAC, and LC3. Bluetooth audio support now provides a 24-bit input through compatible aptX codecs, while the internal Qualcomm QCC3040 Bluetooth receiver handles wireless playback.

Another update Audioengine is including in the A2+ Gen 3 is the switch from Class A/B amplification to Class D, as well as an increase in power output from 15 to 20 watts per channel.

What Makes the A2+ Legacy Special 

The A2+ has remained a successful part of the Audioengine lineup since its initial introduction as the A2, combining high-quality sound, straightforward connectivity, and a compact footprint without requiring apps, accounts, or a complicated setup. The A2+ Gen 3 continues that focus while introducing updated amplification and wireless connectivity to the platform.

“Technology changes, but the reason people buy an A2+ really hasn’t,” Rodriguez said. “They want their music to sound great without turning listening into a project. That continues to be the idea behind this product.”

Comparison

The Bottom Line 

The wireless powered speaker category has become an increasingly popular option for a wide range of audio setups. These include computer workstations, gaming systems, soundbar replacements, and space-saving compact music systems.

Audioengine is a go-to brand in this category, offering consistently solid products that often perform beyond expectations. The periodic upgrades to the A2+, now in its third generation, continue that trend while keeping the price at or below $300.

However, despite the addition of Bluetooth aptX Adaptive, claimed improvements in USB audio, and the switch from Class A/B to Class D amplification, there are still some omissions from the A2+ that may be deal breakers for certain users.

For example, the A2+ still doesn’t provide HDMI ARC or a dedicated phono preamplifier. Adding these two features would noticeably improve setup flexibility, making the A2+ a more practical soundbar alternative while also bringing vinyl enthusiasts into the fold.

It is also important to keep in mind that there is some notable competition from brands such as KEF and Edifier.

KEF commands much higher prices but includes some of the aforementioned features, such as HDMI eARC, on several models, including the LSX II and LSX II LT. KEF also includes Wi-Fi, providing access to more streaming options than Bluetooth alone.

On the other hand, Edifier’s M90 does include HDMI eARC and is often on sale for around $300, while its step-up R2750DB MKII could appeal to listeners who don’t mind a larger speaker.

Ultimately, the Audioengine A2+ Gen 3 is for those looking for a compact desktop audio solution with minimal connectivity needs, or who primarily intend to use its Bluetooth wireless connection.

Where to Buy:

Related Reading:

I do love a gadget, so this mini 20000mAh power bank from Inui really caught my eye. I can’t say it’s the smallest in the world, but it’s certainly ultra-compact and travel-friendly, with a built-in flashlight and USB-C cable that doubles as carry handle.

• Best for: Professionals, students, and travelers who want enough capacity for several phone charges without carrying a separate USB-C cable.

• The deal: The Iniu mini portable charger is now $27 (was $33) at Amazon.

• Why it matters: A 20,000mAh battery provides considerably more endurance than smaller pocket-sized power banks, while 22.5W output offers relatively quick phone charging. The portable unit also features a display, and a flashlight.

Why we recommend it

Its 22.5W fast charging can top up compatible phones much faster than basic 5W or 10W battery packs. Iniu claims an iPhone 16 can reach 60% and a Samsung Galaxy S25 70% in 25 minutes. The built-in flashlight is a useful feature, and the digital display makes it easier to judge when it’s time to plug in the charger.

For more shopping options, take a look at our roundup of the best power chargers.

Should you buy it?

We’re big fans of the Jackery Explorer 2000 v2, which combines a 2,042Wh LiFePO4 battery with enough output to run demanding appliances and equipment.

Best for: Homeowners and campers who need enough stored power to run appliances and equipment rather than simply top up portable electronics.

The deal: The Jackery Explorer 2000 v2 is now $899 (was $999) at Amazon. In the UK, the power station is now £899 (was £1061).

Why it matters: This is the power station that saved our sanity (and our hunger) during power outages when we tested out this unit. Its combination of 2,042Wh capacity and 2,200W output means it can handle much more demanding equipment than smaller portable batteries.

Why we recommend it

In his recent 4.5-star review, our expert Owain said he found it “to be easy to use, simple to transport, and more than capable of dealing with everyday needs.”

It impressed him for several reasons. “Firstly, the build quality and easy setup stand out, limiting setup stress and giving you peace of mind. I also really liked the amount of power you get from such a small and portable unit. I used it extensively in different scenarios, including working, running home appliances, and during a camping trip, and it never even got close to running out. “

The Explorer 2000 v2 provides a lot of AC power across three outlets. Jackery uses a LiFePO4 battery for a service life of up to 10 years. Cell-to-Body construction helps keep the unit relatively compact at 13.2 x 10.4 x 11.5 inches and 39.5lb. There’s also a 100W USB-C PD connection for fast charging compatible laptops, phones and other electronics without needing their regular power adapters.

Price context & historical value

The reduction from $999 to $898.99 knocks $100.01 off the regular price. That’s not close to being its cheapest price however. I’ve seen it for as low as $743.83 on Amazon earlier in the year, and it may well be reduced further for this upcoming Black Friday.

For more options, take a look at our roundup of the best portable power stations.

What once started as a health companion and second screen on your wrist has turned into something a lot more useful. Over the years, smartwatches have continued to become smarter, and their health tracking features are even more accurate. So after reviewing wearables for years, I got used to each new smartwatch generation having just a few polishes and updates.

But Huawei managed to have me obsessed with one of its latest models–and it’s the strap that has my attention. Packed on the underside of the strap is a thin inflatable bladder that runs along the inside of the band. Start a blood-pressure measurement, and that bladder begins expanding against your wrist, tightening in a way that’s familiar to how a doctor wraps a cuff around your upper arm.

This might make the Huawei Watch D3 sound like a thick and heavy wearable tech. But in reality, the Watch D3 is only 11.3mm thick, weighs just over 70 grams with its strap, and has a 1.92-inch AMOLED display. Huawei has also narrowed the inflatable section and made the strap 7.5 grams lighter than before. The blood-pressure feature is fascinating, as the company isn’t making it a software feature.

How does a blood pressure cuff fit inside a watch?

The trick starts with what Huawei calls its 2-in-1 strap-airbag. Rather than having a normal watch band sitting flush against your skin, part of the D3’s strap contains a thin mechanical airbag. When a measurement begins, the watch pumps air into that chamber, causing it to expand inward and apply pressure around your wrist.

Huawei uses the oscillometric method, the same broad measurement principle used by many electronic blood-pressure cuffs. A high-precision pressure sensor works alongside Huawei’s TruSense system to detect the pressure changes created by your pulse while the airbag is inflated. From those changes, the system calculates systolic and diastolic blood pressure.

Again, this is a proper mechanism that doesn’t rely purely on an optical sensor and an algorithm to infer your blood pressure. You can see it in the photos I took. The strap may look unusually thick, but that’s only because it was inflated to take a BP reading. Put the watch on, and that extra material pretty much disappears. You don’t particularly feel it out of place compared to your usual strap. Once you start the measurement, you can physically feel the pressure build as the bladder expands.

Even taking the reading has a very specific posture

To make things as accurate as possible, Huawei gives you some tips for the best possible results, and it starts with your posture. Your watch arm should be steady, elbow bent with your palm facing your chest, while the wrist and palm remain relaxed. It also needs you to support that elbow with your other hand so the Watch D3 sits roughly level with your heart.

Your feet should be flat on the floor and uncrossed, and you’re supposed to remain quiet and avoid moving your fingers, arm, or body while the cuff is working. I was explaining the watch to a friend when taking a measurement, and the Watch D3 promptly told me to pipe down. You can see the posture in the images I’ve shared.

The watch is trying to recreate, on your wrist, the controlled conditions that make a conventional cuff useful. Huawei even asks users to enter their wrist circumference so the watch can match the correct airbag size, with separate M and L strap-airbags supplied for wrists between 130mm and 210mm. So there’s a lot more thought put into this to avoid any kind of misreading. Health is a pretty serious matter for many, so avoiding any false results is key here.

Huawei is doing something very different from Apple and Samsung

Apple’s current Watch implementation looks for patterns associated with hypertension using its optical heart sensor over a 30-day evaluation period. It does not give you an on-demand systolic and diastolic measurement. If the Watch flags possible hypertension, Apple specifically recommends using a third-party cuff for seven days and discussing the results with a healthcare professional.

Samsung goes further. Compatible Galaxy Watches can produce blood-pressure values, but the system first needs to be calibrated against an upper-arm cuff, including three measurements during initial calibration, and Samsung requires recalibration every 28 days. Huawei’s solution, on the other hand, is mechanical by comparison. Sure, the Watch D3 is slightly bulkier and more specialized than a conventional smartwatch, but I find the engineering much more interesting.

It takes it one step further

The Huawei Watch D3’s strap also enables another cool feature, which is ambulatory blood pressure monitoring, or ABPM. You can start a 24-hour monitoring plan and have the watch take readings at preset intervals throughout the day and night. Huawei’s default schedule can prompt daytime measurements every 30 minutes. At night, the Watch D3 can automatically inflate while you’re asleep without requiring you to assume the daytime measurement posture.

Once the monitoring period ends, Huawei Health can show daytime, nighttime, and 24-hour averages and generate an ABPM report that can be saved or printed. Of course, the trade-off here is battery life. Huawei rates the watch for up to six days in typical use, while continuous ABPM cuts that estimate to about one day.

The Watch D3 is still a smartwatch, but it’s also certified

The engineering on the Watch D3 is quite intriguing. Its mechanical moving parts are things that set it apart. Still, it doesn’t look like dedicated medical equipment. On the outside, it has that familiar shape of a smartwatch. The white strap unit I have looks elegant and sleek. Its 1.92-inch display dominates the front. All of the UI and other elements function exactly as you’d expect them to.

It might not look like it, though this is kind of impressive when you read the marketing material. Huawei advertises the Watch D3 as a medical-grade wrist blood-pressure monitor in supported markets, and the UK product page says it is CE-MDR certified. However, measurement availability and regulatory status vary by country. It is worth noting that the measurements should only be treated as guidance. Any unusual results should be properly discussed with an actual healthcare professional. The main advice is not to self-diagnose from a single smartwatch reading.