A critical vulnerability in the Elementor Pro WordPress plugin has been exploited by hackers to compromise numerous websites, with over 190,000 exploit attempts blocked so far. The bug, tracked as CVE-2026-32475, allows an attacker to upload arbitrary PHP files to a website’s server, potentially leading to full site takeover.
The vulnerability affects all versions of Elementor Pro plugin up to 4.2.1 and was patched in version 4.2.2 on August 19. However, threat actors were quick to exploit the defect as soon as the fixes landed, with Defiant reporting that they have blocked over 190,000 attempts so far. This highlights the importance of promptly updating plugins and software to prevent exploitation by malicious actors.
Elementor Pro is a popular drag-and-drop website builder with over 6 million active installations, making it a prime target for hackers. The plugin’s Form widget, which allows users to create customizable forms, contains the vulnerability. An attacker can submit an upload field as an array with two parts: an empty slot that triggers a return, followed by a PHP payload that is uploaded without validation.
The normal behavior of the function that handles form submissions would be to skip the empty entry and continue processing the remaining files. However, the vulnerability results in checks never being applied to the remaining files uploaded through the same form field. This allows an attacker to write a malicious PHP file to the website’s server, which can then be executed to compromise the site.
Site administrators are advised to check their websites for signs of exploitation by looking for the presence of PHP files in the /wp-content/uploads/elementor/forms/ directory. They should also monitor logs for requests to /wp-admin/admin-ajax.php and investigate any suspicious activity.
It’s estimated that approximately two-thirds of Elementor’s 10 million installations run a vulnerable plugin version, highlighting the need for site owners to update their plugins as soon as possible. The fact that hackers have already started exploiting this vulnerability emphasizes the importance of staying on top of security updates and patches to prevent attacks.
To mitigate this risk, website administrators should prioritize updating Elementor Pro to version 4.2.2 or higher, as well as regularly monitoring their websites for signs of exploitation. By taking these steps, site owners can protect themselves from potential attacks and ensure the integrity of their online presence.
Source: SecurityWeek — 2026-09-05