Active Exploits Target Elementor Pro Weakness, Compromising WordPress Sites

A critical security flaw identified as CVE-2026-32475 in the Elementor Pro plugin for WordPress is now being leveraged by attackers to drop webshells on vulnerable sites and run arbitrary commands on the underlying server.

The vulnerability, which was patched only weeks ago, stems from improper input handling in a core Elementor Pro endpoint. By sending specially crafted requests, an unauthenticated actor can trigger code execution without needing legitimate credentials.

Security researchers who first disclosed the issue observed that threat actors are already exploiting the flaw in the wild. The typical attack chain involves delivering a lightweight webshell payload that grants the intruder persistent, low‑level access to the compromised host, allowing further manipulation, data exfiltration, or site defacement.

Elementor Pro powers a large segment of the WordPress ecosystem, especially among users who rely on its drag‑and‑drop page‑building capabilities. Because WordPress sites collectively represent a substantial share of the web, the exposure of a popular plugin translates into a broad attack surface. Sites that have not applied the recent update are at heightened risk of being commandeered.

The plugin’s developer responded quickly after the vulnerability was reported, releasing an emergency patch that addresses the input validation flaw. The advisory, first highlighted by BleepingComputer, urges all Elementor Pro users to upgrade to the latest version immediately and to review server logs for any signs of suspicious activity.

Experts caution that the episode underscores a persistent challenge in the WordPress ecosystem: the reliance on third‑party extensions that may lag behind core security updates. Administrators are advised to adopt a layered defense strategy, including regular plugin updates, principle‑of‑least‑privilege configurations, and web‑application firewalls that can block known exploit patterns.

Looking ahead, security teams expect to see continued scanning for unpatched installations, as attackers often automate the search for vulnerable plugins. Organizations that maintain WordPress sites are encouraged to monitor vulnerability feeds, apply patches promptly, and consider routine security audits to mitigate the risk of similar exploits resurfacing in the future.