A critical vulnerability CVE-2026-32475 in the Elementor Pro WordPress plugin is being actively exploited in the wild. Attackers are leveraging the flaw to deliver webshell payloads onto compromised servers, enabling arbitrary command execution. The vulnerability has been patched, but exploitation is ongoing against unpatched installations. WordPress site owners using Elementor Pro are urged to apply the patch immediately. The attacks represent a significant risk as Elementor Pro is widely used across millions of WordPress sites, making the attack surface extremely large. Successful exploitation could lead to full site takeover and server compromise.
CVE-2026-32475 is a critical vulnerability in Elementor Pro (versions 4.2.1 and earlier) caused by faulty validation of file-upload arrays in Elementor Pro forms. An attacker submits the form's File Upload field as an array where the first element is an empty file and the second element is a malicious PHP file with a .php extension. This structure triggers a validation bypass, causing the plugin to stop validating subsequent files. The uploaded malicious PHP file (webshell) is stored under /wp-content/uploads/elementor/forms/ under a randomly generated filename with a .php extension. The attacker can then directly request this file to execute arbitrary commands on the server (Remote Code Execution). Exploitation requires the target site to have a published Elementor Pro Form widget with at least one File Upload field. Active exploitation began on August 19, 2026, the same day the patch was released, with Wordfence blocking over 190,000 exploitation attempts between August 19 and 23.
1. Immediately upgrade Elementor Pro to version 4.2.2 or later to patch CVE-2026-32475. 2. Inspect the /wp-content/uploads/elementor/forms/ directory for any rogue PHP files, as the presence of PHP files in this directory is a strong indicator of compromise. 3. If PHP files are found in that directory, initiate clean-up operations to remove the webshells and investigate for further compromise. 4. Add known malicious IP addresses (as published by Wordfence) to blocklists. 5. Consider deploying a web application firewall such as Wordfence to detect and block exploitation attempts. 6. Review all published Elementor Pro Form widgets to audit File Upload field configurations.
PHP files present in the /wp-content/uploads/elementor/forms/ directory, File upload requests where the upload field is submitted as an array with an empty first element and a PHP file as the second element, Uploaded .php files with randomly generated filenames in /wp-content/uploads/elementor/forms/
