A critical vulnerability in Elementor Pro is being actively exploited, putting millions of WordPress websites at risk of remote code execution and potentially complete site takeover.
Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro 4.2.1 and earlier and has a CVSS score of 9.8, placing it in the critical severity category. Elementor released version 4.2.2 on August 19, 2026 to fix the issue.
The timing is concerning because attackers began exploiting the vulnerability on the same day it was publicly disclosed. Wordfence says its firewall has already blocked more than 190,000 exploit attempts. Elementor Pro has more than 6 million active installations, although the vulnerability requires a specific form configuration to be exploitable.
The vulnerability is found in the File Upload field of Elementor Pro’s Form widget.
For a site to be vulnerable, it needs a published page containing an Elementor Pro Form with a File Upload field that is not required. The security problem comes from how the plugin validates multiple uploaded files.
When an attacker submits an empty first upload followed by another file, the validation process stops at the empty entry instead of continuing to validate the remaining files. This allows the second file to bypass extension and file-type checks.
An attacker can therefore upload a file with an arbitrary extension, including a PHP file, without authentication.
Wordfence observed attacks targeting WordPress’s admin-ajax.php endpoint through the elementor_pro_forms_send_form action. In these requests, the File Upload field is submitted as an array, with an empty entry placed before the malicious file.
A successfully uploaded file is placed in:
/wp-content/uploads/elementor/forms/
If the server allows PHP execution from that directory, the attacker can access the uploaded file and execute commands. That could provide a foothold for installing backdoors, modifying website files or taking further control of the hosting environment.
This is what makes the vulnerability much more serious than a normal file upload bypass. The initial flaw is in file validation, but the potential impact can extend to full remote code execution.
Wordfence observed significant exploitation activity between August 19 and August 23, with some attacking IP addresses generating thousands of blocked requests. That activity makes this a vulnerability that should not be left for a routine maintenance window. Attackers were already scanning for vulnerable websites as soon as the flaw became public.
If you use Elementor Pro, update to version 4.2.2 or newer immediately. However, updating alone may not be enough if the website was exposed before the patch was installed. Administrators should also check the Elementor forms upload directory for unexpected .php files. Such files should not normally be present there and could indicate an attempted or successful compromise.
It is also worth reviewing server access logs for suspicious requests to:
/wp-admin/admin-ajax.php
Especially requests using the elementor_pro_forms_send_form action. An attack request does not necessarily mean the exploit succeeded, but unexpected PHP files combined with suspicious requests should be investigated.
Wordfence says its Malicious File Upload Protection can block exploitation attempts and also recommends enabling “Disable Code Execution for Uploads directory” in Wordfence’s Global Options.
These protections add another layer of defense, but they should not replace the plugin update. The underlying vulnerability needs to be patched.
The incident also shows a broader problem with WordPress security. A seemingly small validation mistake can become a serious server-side vulnerability when a plugin processes user-controlled files. With millions of installations, the window between public disclosure and active exploitation can also be extremely short.
If you run Elementor Pro, update it now and check your website for signs of compromise if it was running an affected version.
For businesses and website owners that need help, our WordPress security services include security audits, vulnerability assessments, malware and backdoor detection, compromised website cleanup and ongoing WordPress security monitoring.
Related Posts
