The filming drone was hovering above competitors in Geraldton's Endure Batavia Triathlon about 9:00am on Sunday when the operator lost control.
It dropped about 10 metres, and competitor Raija Ogden says it hit her.
Mrs. Ogden said she then sat down because she thought she was going to faint.
She sustained head injuries and was treated by paramedics before being taken to hospital in a stable condition.
There have been conflicting accounts about whether Mrs. Ogden was hit by the drone or whether she fell and was injured after being startled by it.
in an interview with the ABC, Mrs. Ogden was adamant she was struck by
the device, and said there were a number of witnesses.
Mrs. Ogden said the outcome of the crash could have been much worse.
"Basically we should all just thank our lucky stars that there [were] no injuries to a child or nobody's eye got taken out," she said.
Mrs. Ogden said she was in the early stage of the running component of the triathlon when she was hit by the drone.
She sustained a number of head injuries and required three stitches.
She said despite feeling "sore and tired", she was not put off by the ordeal and will return to Geraldton to compete in races.
"Geraldton is a great town and the Geraldton Triathlon Club is hosting a great event," she said.
"I was participating in a great regional community event and it's really a shame that the incident happened."
The drone is owned by local videographer Warren Abrams who said video footage clearly showed the drone drop just behind Mrs. Ogden.
He said the nature of her injuries suggested the drone missed her.
CASA said there were clear rules covering the operation of an unmanned aircraft, including the requirement to fly a minimum of 30 metres away from people.
In a statement the authority said the incident was a clear reminder of the need for operators of unmanned aircraft to obey safety regulations at all times.
Mr. Abrams company, New Era Photography and Film, was covering the event.
Operators of all unmanned drones used in a commercial capacity are required to be certified.
Neither Mr. Abrams nor his business appear on the list of the 92 operators certified nationally.
Mr. Abrams said an initial investigation had indicted that someone nearby "channel hopped" the device, taking control away from the operator.
Channel hopping is a form of hacking which can render the drone uncontrollable to the original operator.
Mr. Abrams said it was a deliberate act and it would be difficult to determine who was responsible as something as common as a mobile phone could be used to perform a channel hop.
The videographer added that there had been a similar incident when the drone was flown earlier in the day.
He said a full check was conducted and the device was taken elsewhere for a test flight, but he said no issues were detected.
CASA spokesman Peter Gibson said he was confident sophisticated drones used in commercial operations would not be able to be controlled or hacked in that way.
"[But] the simpler ones that you can go down to a store and buy, maybe that is possible given that they're that much more basic," he said.
"[It's] very unlikely they're going to be used in commercial operations where they're going to be near people or property."
The organisers of the race said the incident should never have occurred.
In a statement, Geraldton Triathlon Club president Simon Teakle said a full investigation would be conducted into how the accident occurred and the circumstances surrounding it.
The club has offered its apologies to the injured competitor.
About 200 competitors took part in the triathlon.
Hai Tran, who runs a commercial drone company headquartered in Perth, said that in the hands of professional pilots the unmanned vehicles are safe.
But he warned that in the hands of amateurs they could be a real risk.
"A lot of the amateur photographers, amateur aerial cinematographers are flying around places [where] you just shouldn't be flying these things unless you're very, very experienced," he said.
Edith Cowan University academic Dr Mike Johnstone's initial research indicates some drones may be vulnerable to electronic hijacking.
"The video stream ... whether we could take that over or intercept that ... it looks like at the moment that is potentially possible," he said.