A critical vulnerability in Elementor Pro, a widely used WordPress plugin, has been exploited by attackers to take over thousands of websites. The issue, which was patched on August 19, allows hackers to upload webshells and execute arbitrary commands on the server. With nearly 200,000 exploitation attempts blocked by Defiant’s Wordfence web application firewall in just a few days, it’s clear that this vulnerability has become a pressing concern for WordPress site owners.
Elementor Pro is a popular plugin with over 6 million active installations, used to build websites using a drag-and-drop interface. The CVE-2026-32475 vulnerability affects versions 4.2.1 and earlier of the plugin. It stems from faulty validation of file-upload arrays in Elementor Pro forms, which can be exploited by submitting an empty file as the first array element and a malicious PHP file as the second. This allows attackers to bypass normal validation procedures and upload arbitrary files to the website.
Once the payload is uploaded, it’s stored under /wp-content/uploads/elementor/forms/, where it can be accessed remotely to execute commands. WordPress security platform Patchstack warned last month that this vulnerability could be used to upload arbitrary PHP files and trigger PHP code execution on the server. The exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, which is a common configuration.
According to Wordfence, activity exploiting CVE-2026-32475 started on August 19, the same day Elementor released version 4.2.2 that addressed the vulnerability. “The attacker submits the form’s File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php filename,” Wordfence explains. “Once written, the uploaded PHP file is placed in the /wp-content/uploads/elementor/forms/ directory under a randomly generated filename with the attacker-supplied .php extension.”
Administrators should upgrade to Elementor Pro 4.2.2 or later immediately and inspect the /wp-content/uploads/elementor/forms/ directory for rogue PHP files. Since this location is used to store uploaded form submissions, the presence of a PHP file is a strong indicator of compromise that should trigger clean-up operations.
It’s essential to note that once attackers have valid credentials, only 37% of their actions are blocked, as prevention scores can hide what happens after initial access. This highlights the importance of regular security updates and vigilant monitoring of website activity. With thousands of sites already compromised, it’s crucial for administrators to act quickly to prevent further exploitation of this vulnerability.
Source: Bleeping Computer — 2026-09-03