Attackers have begun exploiting a critical vulnerability in the Elementor Pro plugin for the WordPress platform. The vulnerability allows a malicious PHP file to be uploaded to the server and then remote commands to be executed. The vulnerability is tracked as CVE-2026-32475, and Elementor fixed it in version 4.2.2, released on August 19.
The plugin has more than 6 million active installations and is used to build WordPress pages and websites through a drag-and-drop interface. According to Defiant, the developer of the Wordfence platform, its web application firewall blocked nearly 200,000 exploitation attempts targeting its customers after the vulnerability was fixed.
How does the exploitation work?
The issue is related to a flaw in the validation of file arrays uploaded through Elementor Pro forms. An attacker can submit an empty file as the first item in the array and then attach a malicious PHP file as the second item. This arrangement causes validation of subsequent files to stop, allowing the malicious payload to pass through.
After the file is uploaded, it is stored in the /wp-content/uploads/elementor/forms/ path under a random name while retaining the .php extension specified by the attacker. The file can then be accessed directly to run commands on the server, giving the attacker the ability to execute instructions remotely.
When is a site at risk?
Exploitation does not require any arbitrary form to exist on the site, but it does require the published site to contain an Elementor Pro Form element with at least one File Upload field. According to the source, these are common settings on sites that rely on the plugin.
Wordfence issued an alert about the attack activity on September 2 and said the attacks began on the same day Elementor released version 4.2.2. The company recorded increased activity between August 19 and 23, with more than 190,000 blocked exploitation attempts. It also provided a list of IP addresses used by attackers in thousands of attacks so that defenders could add them to blocklists.
What should site administrators do?
Elementor Pro should be updated to version 4.2.2 or later immediately. The alert also recommends checking the /wp-content/uploads/elementor/forms/ path for unknown PHP files. Since this path is intended to store files uploaded through forms, the presence of a PHP file there is a strong indicator of a possible site compromise and warrants cleanup and investigation.
Why does this matter?
The importance of the vulnerability lies not only in the number of installations, but also in the fact that the exploitation turns a file-upload function within a web form into a point for executing commands on the server. The attacks beginning on the day the patch was released also leave a short window for sites that have not yet been updated. The source does not establish how successful all the attacks were, but it confirms the existence of widespread active exploitation and large numbers of blocked attempts. Therefore, checking uploaded files and server logs remains a necessary step alongside updating.