A critical vulnerability in the Elementor Pro plugin for WordPress has been exploited by attackers, allowing them to take control of millions of websites. The flaw, patched on August 19, was being used to deliver a webshell payload and execute arbitrary commands on the server.
Elementor Pro is one of the most popular plugins for building websites using a drag-and-drop interface. With over 6 million active installations, it’s clear that many site owners rely on this plugin for their online presence. The vulnerability, identified as CVE-2026-32475, affects versions 4.2.1 and earlier of Elementor Pro.
The issue lies in the way Elementor Pro handles file uploads through its forms feature. By submitting an empty file as the first element in a file array and a malicious PHP file as the second, attackers can bypass the plugin’s validation checks and upload their own payload. This uploaded file is then stored on the server, allowing attackers to execute commands remotely.
According to Wordfence, over 200,000 exploitation attempts were blocked since the patch was released. The security firm also notes that exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, which is a common configuration.
As soon as attackers gain access to a site’s server, they can execute arbitrary commands and potentially install malware or backdoors. This is exactly what happened in the case of CVE-2026-32475, where attackers were using webshells to take control of compromised sites. The good news is that Elementor released version 4.2.2 on August 19, which patches this vulnerability.
Administrators are urged to upgrade to Elementor Pro 4.2.2 or later immediately and inspect the /wp-content/uploads/elementor/forms/ directory for rogue PHP files. Since this location is used to store uploaded form submissions, finding a PHP file here is a strong indication of compromise that requires immediate attention.
It’s essential for site owners to be proactive in securing their online presence. Regularly updating plugins like Elementor Pro and monitoring server logs can help prevent such attacks from succeeding. By staying vigilant and taking prompt action when vulnerabilities are discovered, we can minimize the risk of our websites falling prey to malicious actors.
Source: Bleeping Computer — 2026-09-03