WordPress Sites Targeted After Critical Elementor Pro Bug Exploited

Security researchers have confirmed that a newly patched critical flaw in the Elementor Pro plugin for WordPress – catalogued as CVE-2026-32475 – is already being leveraged by threat actors to gain full control of vulnerable websites. The exploit delivers a web‑shell payload that allows attackers to execute arbitrary commands on the underlying server, effectively handing over the site to malicious operators.

The vulnerability stems from insufficient validation of data submitted to a specific Elementor Pro endpoint, which permits unauthenticated users to upload files that are later processed as executable code. By crafting a request that bypasses the plugin’s file‑type checks, attackers can plant a PHP web‑shell and then issue system commands at will. The Elementor development team released a patch in the latest version of the plugin, but the fix only mitigates the issue for sites that apply the update promptly.

Early indicators of active exploitation emerged within days of the public advisory. Analysts have observed a pattern in which compromised sites receive a short‑lived request that drops a hidden web‑shell, followed by a second request that uses the shell to run commands such as downloading additional malware, creating new admin accounts, or mining cryptocurrency. The attacks appear to be opportunistic, focusing on WordPress installations that continue to run outdated versions of Elementor Pro despite the availability of the security update.

Experts warn that the consequences of a successful compromise can be severe. Beyond defacement or data theft, attackers can pivot from the compromised server to other parts of an organization’s network, exfiltrate customer information, or use the site as a launchpad for broader phishing campaigns. Site owners are urged to update Elementor Pro to the patched release immediately, audit file systems for unfamiliar scripts, rotate all WordPress credentials, and enable server‑level security measures such as ModSecurity and file integrity monitoring.

The incident highlights a persistent challenge in the WordPress ecosystem: the reliance on third‑party plugins that may lag behind core security practices. Elementor Pro powers millions of sites worldwide, making any flaw in its code a high‑value target. The responsible disclosure process, first reported by BleepingComputer, underscores the importance of coordinated vulnerability handling between researchers, plugin developers, and platform maintainers. As the community pushes for faster patch cycles and better update hygiene, site operators are reminded that timely maintenance remains the most effective defense against emerging threats.