- The Mess: A critical Elementor Pro vulnerability is now being exploited in the wild, with attackers uploading PHP webshells and executing commands on vulnerable WordPress servers. The flaw, tracked as CVE-2026-32475, affects Elementor Pro 4.2.1 and earlier.
Elementor Pro has more than 6 million active installations. That makes this less of a niche plugin bug and more of a ready-made attack surface spread across millions of WordPress sites.
The vulnerability sits in Elementor Pro’s Forms module, specifically its File Upload functionality.
The bug comes from two pieces of code that disagree about how uploaded files should be validated.
An attacker can submit multiple file parts where the first entry is empty and the second contains a malicious PHP file. The validation logic stops processing the upload after encountering the empty entry, while the later processing logic still moves the malicious file onto the server.
The result is ugly: a PHP payload can land inside the site’s public uploads directory.
Once the attacker knows the filename, they can request it directly and execute PHP code on the server.
That turns an innocent-looking contact, support or application form into a potential remote command execution entry point.
And there is no WordPress login requirement.
The attack does require one specific configuration: the site must have a published Elementor page containing a Form widget with a File Upload field. That is hardly an exotic setup. Job applications, support forms, receipt uploads and similar workflows commonly use exactly this feature.
Elementor released version 4.2.2 on August 19, 2026, fixing the vulnerability.
The timing is now the bigger problem.
According to Wordfence, exploitation began on the same day the patch was released. Since then, its firewall has blocked almost 200,000 exploitation attempts targeting protected sites.
That means defenders are not dealing with theoretical exploitation or researchers demonstrating a bug in a lab.
Attackers are actively looking for vulnerable WordPress installations.
Public exploit information also exists. Security researchers have documented the upload technique, and a public proof-of-concept implementation is available.
A successful attack can give the intruder arbitrary PHP execution with the privileges of the web server process. From there, the attacker can deploy a persistent webshell, create rogue administrator accounts, modify WordPress files, inject redirects, steal credentials or use the compromised website as infrastructure for another campaign.
This is also why a simple version check is not enough after exploitation starts.
A site running an old Elementor Pro version should be treated as potentially compromised if it was exposed during the vulnerable period.
Administrators should update Elementor Pro to 4.2.2 or later, then inspect the site for unexpected PHP files, unknown administrator accounts, modified plugins and themes, suspicious scheduled tasks and unexplained outbound connections.
The directory deserves particular attention:
wp-content/uploads/elementor/forms/
A PHP file appearing there is not automatically malicious, but an unexpected .php file in that location should trigger an investigation.
The vulnerability was disclosed with a CVSS score of 9.0, although some secondary databases currently display different scoring. The important part is not the number anyway: the flaw provides an unauthenticated path from a public form upload to server-side PHP execution.
- The Damage: An unauthenticated visitor can turn a vulnerable Elementor form into a webshell installation point and potentially take complete control of the WordPress server.
- The Fix: Update Elementor Pro to 4.2.2 or later immediately, then scan for signs of compromise if the vulnerable version was exposed to the Internet.
Bugstoday Opinion
This is exactly the kind of WordPress vulnerability attackers love.
No stolen password.
No administrator account.
No exotic exploit chain.
Just a public form, a broken upload validation loop and a PHP file.
The patch has been available since August 19. Nearly 200,000 blocked exploitation attempts later, anyone still running 4.2.1 or older is basically leaving a loaded weapon pointed at their own web server.
And once attackers get PHP execution, calling it an Elementor problem is being overly optimistic.
It becomes a server problem.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- CVE.org — CVE-2026-32475
- NVD — CVE-2026-32475
- Wordfence — Critical Arbitrary File Upload Vulnerability in Elementor Pro
- Patchstack — Elementor Pro Security Advisory
- BleepingComputer — Critical Elementor Pro Flaw Exploited
- Elementor Pro Security Update
