Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- elementor pro (wordpress)
- Patched version
- Not yet available
An arbitrary file upload vulnerability in the Elementor Pro WordPress plugin has been reportedly exploited to hack websites. Users of Elementor Pro are advised to upgrade and review site files.
What happened
An early warning has been issued regarding a critical-severity vulnerability in the Elementor Pro WordPress plugin. Tracked as CVE-2026-32475 with a CVSS score of 9.8, the issue is an arbitrary file upload vulnerability in the function that handles form submissions. This vulnerability has been exploited in the wild to hack websites, according to WordPress security firm Defiant. Elementor Pro is the paid version of the popular Elementor plugin, which offers additional features including a Form widget with support for File Upload fields.
The vulnerability allows unauthorized file uploads, which can be leveraged by attackers to execute malicious code on affected websites. WordPress site administrators using Elementor Pro are urged to take immediate action to mitigate potential risks.
What to do about it
- Upgrade to the latest version of Elementor Pro as soon as it becomes available.
- Review your website's files for any unauthorized uploads that may indicate a compromise.
- No official fix has been published yet. Monitor the sources below for updates on patched versions.
How 0Day would have caught this
elementor pro is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Elementor Pro WordPress plugin, you may be affected. The specific version range has not been published yet.
What should I do right now?
Upgrade to the latest version of Elementor Pro and review your site files for any unauthorized uploads.
Has this been exploited in the wild?
Yes, the vulnerability has been reportedly exploited to hack websites.