Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Elementor Pro WordPress plugin vulnerability (CVE-2026-32475) exploited for arbitrary file uploads.
Run Defiant?
Get an email when a reviewed story names Defiant, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Hackers are actively exploiting a critical arbitrary file upload vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin, which has a CVSS score of 9.8. This flaw allows unauthenticated attackers to upload PHP payloads to websites, potentially leading to full site compromise. The vulnerability impacts versions up to 4.2.1 and has been patched in version 4.2.2, but exploitation began immediately after the fix.
The lesson from this incident
Full lessonA critical unauthenticated file upload vulnerability (CVE-2026-32475, CVSS 9.8) in the Elementor Pro WordPress plugin allowed attackers to upload malicious PHP payloads and fully compromise affected websites without any credentials. The root cause lies in inadequate input validation and file upload controls within a widely-used third-party plugin, highlighting the risks of supply chain dependencies in CMS ecosystems. Exploitation began almost immediately after the patch was released, demonstrating how threat actors monitor vulnerability disclosures to strike before administrators can respond. This incident underscores the critical importance of rapid patch deployment cycles, especially for internet-facing web applications running popular plugins with large install bases. Delayed patching in high-severity, actively exploited scenarios can result in complete site takeover, data theft, and malware distribution to site visitors.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-32475