Critical Elementor Pro flaw exploited to take over WordPress sites
Critical Elementor Pro vulnerability (CVE-2026-32475) exploited to take over WordPress sites.
Run Wordfence?
Get an email when a reviewed story names Wordfence, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability in the Elementor Pro WordPress plugin, CVE-2026-32475, is being actively exploited to deliver webshells and execute arbitrary commands. The flaw, present in versions 4.2.1 and earlier, allows attackers to bypass file validation by submitting a specially crafted file upload. This enables them to upload malicious PHP files to the server, leading to potential site takeovers.
The lesson from this incident
Full lessonA critical file upload validation bypass in Elementor Pro (CVE-2026-32475) allowed attackers to upload malicious PHP webshells to WordPress servers, granting full remote code execution and site takeover capabilities. The root cause was insufficient server-side file type validation, meaning attackers could craft a request that circumvented the plugin's upload controls entirely. This vulnerability was actively exploited in the wild before many site owners had applied patches, highlighting the danger of delayed updates for widely-used third-party plugins. Because WordPress plugins extend the attack surface of millions of sites simultaneously, a single critical flaw in a popular plugin becomes a high-value, high-impact target for threat actors at scale.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
- cve — CVE-2026-32475