CVE-2026-32475

A patched upload bug in Elementor Pro is now a live webshell delivery path, and the clock started the day the fix shipped CVE-2026-32475, a critical validation flaw in the Elementor Pro plugin for WordPress, is being exploited in the wild to drop webshells on business websites. The bug let attackers upload a PHP file…