Elementor Pro CVE-2026-32475 exploited in WordPress site takeovers

A critical, recently patched vulnerability in Elementor Pro (CVE-2026-32475) is under active exploitation, with attackers deploying webshells and executing arbitrary commands on affected WordPress servers. The flaw was patched but unpatched sites remain at risk; the scale of compromise is unclear. This matters because Elementor Pro is widely used, making this a high-impact supply-chain style threat to a large install base.