Critical Elementor Pro flaw exploited to take over WordPress sites

By Bill Toulas

AI Summary

CVE-2026-32475, a recently patched critical vulnerability in the Elementor Pro WordPress plugin, is being actively exploited to deploy webshells and execute arbitrary server-side commands. Given that Elementor Pro is installed on millions of WordPress sites, the attack surface is substantial. Security teams managing WordPress environments should verify plugin update status and audit for webshell indicators of compromise immediately.

Read full article → https://www.bleepingcomputer.com/news/security/cri…

Relevance score: 86.0/100

# More from September 04

1
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners The Hacker News
2
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root The Hacker News
3
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone The Hacker News
4
Sality botnet infrastructure dismantled in joint global takedown BleepingComputer
5
Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data The Hacker News
7
OpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold SecurityWeek
8
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens BleepingComputer
9
153 Million Driver License Images Offered on Dark Web SecurityWeek
10
BGP hijack infecting networks caused by a comedy of errors that’s not funny at all Ars Technica Security