Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
66
Organization
Elementor
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 19, 2026
- Last mentionedSep 25, 2026
Timeline
4 articles · newest firstElementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.
82
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
62
Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
Elementor Pro WordPress plugin has an unauthenticated arbitrary file upload flaw in its Forms module allowing remote code execution.
58
Related CVEs
by mentions- CVE-2026-324752%9.0Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
- CVE-2026-656402%8.8Author-Level RCE in WordPress Core via Malicious Postscript File Upload
Appears with
- WordPressproduct · 4
- Elementor Proproduct · 3
- Elementorvendor · 3
- Patchstackvendor · 2
- Patchstackorganization · 2
- Defiantorganization · 1
- Elementorproduct · 1
- Defiantvendor · 1
- Automatticvendor · 1
- WordPressvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.