🔴 Critical: Critical Elementor Pro flaw exploited to take over WordPress sites

[XploitLK-Bot]

A critical authentication bypass vulnerability in Elementor Pro for WordPress, tracked as CVE-2026-32475, is now being actively exploited in the wild. Attackers are leveraging the flaw to deploy webshell payloads, granting them the ability to execute arbitrary commands directly on the affected server.

The flaw, which was patched in a recent update, allows unauthenticated attackers to bypass access controls and take over vulnerable WordPress sites. Successful exploitation leads to full site compromise, including the potential for data theft, malware injection, and persistent backdoor access via the injected webshell.

Given the active exploitation, site administrators running Elementor Pro should verify they are on the latest patched version immediately.

• Affected software: Elementor Pro versions prior to the latest security release.
• Observed payload: Webshell that enables remote command execution.
• Impact: Full site takeover, arbitrary code execution, persistent backdoor access.

If you manage a WordPress site, confirm that automatic updates are enabled for Elementor Pro, or manually apply the vendor’s security patch without delay. Additionally, audit your server for any suspicious files or unexpected administrator accounts that may indicate prior compromise.

Source: BleepingComputer

Is your organization running Elementor Pro, and how are you verifying that no unauthorized webshells or backdoors were planted before you applied the latest patch?