A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. Elementor Pro is a popular WordPress plugin with more than 6 million active installations, allowing users to build websites using a drag-and-drop interface. The CVE-2026-32475 vulnerability was patched on August 19. Since then, Defiant's Wordfence web application firewall has blocked almost 200,000 exploitation attempts targeting its clients. The issue stems from faulty validation of file-upload arrays in Elementor Pro forms and is present in versions 4.2.1 and earlier. By submitting an empty file as the first array element and a malicious PHP file as the second, attackers can cause the plugin to stop validating subsequent files. The uploaded payload is stored under /wp-content/uploads/elementor/forms/ and can then be accessed to execute commands remotely. WordPress cybersecurity platform Patchstack warned last month that attackers could exploit it to upload arbitrary PHP files and trigger PHP code execution on the server. Exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, a common configuration. Yesterday, Wordfence alerted that activity exploiting CVE-2026-32475 started on August 19, the same day Elementor released version 4.2.2 that addressed the vulnerability. “The attacker submits the form’...
Critical Elementor Pro flaw exploited to take over WordPress sites
BleepingComputer
·Bill Toulas
·Published Sep 3, 2026
·Updated
Affected Software
1 affected component
Elementor Elementor Pro (WordPress plugin)
Frequently Asked Questions
1
Which Elementor Pro versions are affected by CVE-2026-32475?
The flaw is present in Elementor Pro version 4.2.1 and earlier. The vulnerability was patched on August 19.
2
How do attackers exploit the file-upload validation flaw?
Attackers submit an empty file as the first element of a file-upload array and a malicious PHP file as the second. This causes Elementor Pro to stop validating subsequent files, allowing the PHP payload to be uploaded.
3
What can an attacker do after successful exploitation?
The uploaded payload is stored under /wp-content/uploads/elementor/forms/ and can be accessed to execute commands remotely on the server. Patchstack warned that the issue can be used to upload arbitrary PHP files and trigger PHP code execution.
4
Is exploitation occurring in the wild?
Yes. Since the August 19 patch, Defiant's Wordfence web application firewall has blocked almost 200,000 exploitation attempts targeting its clients.