Critical Elementor Pro Vulnerability Enables Global Website Takeovers

LONDON — A critical security flaw in the widely used Elementor Pro WordPress plugin is being actively exploited by attackers to seize control of websites globally, allowing the execution of arbitrary commands and the upload of malicious files. The vulnerability, identified as CVE-2026-32475, stems from a validation bypass in file-upload arrays within the plugin's code, enabling unauthorized actors to inject harmful PHP scripts into compromised sites.

The attack campaign was detected on Wednesday, September 3, 2026, at approximately 14:54 UTC. Security researchers observed that the flaw allows attackers to bypass standard security checks designed to restrict file types and destinations. Once exploited, the vulnerability grants intruders full administrative access to the affected WordPress installation. This level of access permits the defacement of websites, the theft of sensitive user data, and the use of compromised servers as launchpads for further attacks against other networks.

Elementor Pro is one of the most popular page-building tools for WordPress, powering millions of sites across diverse sectors including e-commerce, news media, and corporate portfolios. The widespread adoption of the plugin means the potential impact of this vulnerability is extensive. Administrators of affected sites are urged to update their installations immediately or implement emergency patches if an official update is not yet available. Until a fix is deployed, site owners may need to disable the plugin entirely to prevent unauthorized access.

The mechanism of the exploit involves manipulating the file-upload arrays that handle user-submitted content. By circumventing the validation logic, attackers can upload executable PHP files disguised as legitimate assets. Once these files are stored on the server, they can be triggered to run system commands, effectively handing over control of the server to the attacker. This technique has been observed in various botnet operations and ransomware distribution campaigns in recent years.

While the vulnerability is now known, the full extent of the damage remains unclear. It is not yet determined how many sites have already been compromised or if data exfiltration has occurred on a large scale. Some security firms are monitoring for signs of lateral movement within networks that host affected WordPress instances. The speed at which attackers have moved to exploit the flaw suggests they may have discovered the vulnerability prior to its public disclosure.

Questions remain regarding whether other plugins with similar file-handling architectures are susceptible to this specific bypass technique. Additionally, it is unknown if any of the compromised sites were used to host phishing campaigns or distribute malware in the hours following the initial detection. As website administrators scramble to secure their platforms, the incident highlights the ongoing risks posed by unpatched vulnerabilities in widely deployed web software.