Hackers are actively exploiting a critical vulnerability in Elementor Pro, a popular website builder plugin for WordPress with at least 11 million installs. The flaw was discovered by a researcher from NinTechNet, who published a working proof-of-concept (PoC) exploit at the end of March 2023. The exploit only affects instances of Elementor Pro that are running on a website that has WooCommerce activated. WooCommerce is a very popular open-source software solution used to turn websites into e-commerce shops online. The exploit stems from a broken access control vulnerability which allows any authenticated users visiting the website to make changes to the website’s settings, potentially allowing the attacker to conduct a full takeover of the site. If successfully exploited, an authenticated attacker could elevate their privileges to make themselves a website administrator. This would allow them to carry out a number of malicious activities including redirecting all user traffic to an actor-controlled command-and-control (C2) server, as well as uploading backdoors and other malicious code. This vulnerability impacts v3.11.6 and earlier, and CTIX analysts recommend all site administrators leveraging vulnerable instances of Elementor Pro and WooCommerce to upgrade to version 3.11.7 or later as soon as possible.