Critical

Critical Elementor Pro flaw exploited to take over WordPress sites

BleepingComputer

September 3, 2026 at 2:52 PM

Actively Exploited

Overview

A serious vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress has been discovered and is currently being exploited by attackers. This flaw allows them to deliver a webshell payload, enabling them to execute arbitrary commands on compromised servers. Websites using Elementor Pro are particularly at risk, as the vulnerability can lead to full site takeover. The situation is urgent, as the vulnerability is actively exploited, highlighting the need for immediate action from site administrators to protect their data and resources. Users of this plugin should ensure they have updated to the latest version to mitigate the risk of exploitation.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Elementor Pro plugin for WordPress
Action Required: Users should update the Elementor Pro plugin to the latest version as soon as possible to patch the vulnerability.
Timeline: Newly disclosed

Original Article Summary

A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. [...]

Impact

Elementor Pro plugin for WordPress

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should update the Elementor Pro plugin to the latest version as soon as possible to patch the vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Critical.

Read Original Article

Related Coverage

Attackers exploit zero-days in consistently besieged SonicWall product

CyberScoop

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

Sep 3, 2026

Coder's registry infrastructure compromised to push malicious modules

BleepingComputer

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Sep 3, 2026

HPE patches critical ArubaOS-CX remote code execution flaw

BleepingComputer

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

Sep 3, 2026

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The Hacker News

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Sep 3, 2026

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

The Hacker News

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

Sep 3, 2026

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

SecurityWeek

The Manchester Airports Group (MAG) has suffered a significant data breach, with hackers leaking around 550GB of sensitive information related to 8.8 million individuals. This incident occurred after MAG reportedly declined to meet the ransom demand from the attacking group. The hackers claimed they accessed the data through exposed administrative keys, raising concerns about the security measures in place at the airport group. This breach not only compromises the personal information of millions but also highlights the ongoing risks organizations face from ransomware attacks and the importance of securing sensitive data. As the fallout from this incident unfolds, it serves as a reminder for companies to reinforce their cybersecurity practices and be vigilant against potential vulnerabilities.

Sep 3, 2026