Elementor Pro flaw exposes WordPress sites to mass exploitation
Critical flaw
CVE-2026-32475 affects Elementor Pro versions up to and including 4.2.1 and is reported as critical.
Active exploitation
Attackers are exploiting the bug to upload executable files that can lead to site takeover.
Patch available
Administrators should update Elementor Pro to version 4.2.2 or later and check for existing compromise.
A critical vulnerability in the Elementor Pro WordPress plugin is being exploited to compromise websites, showing how widely deployed plugins can quickly become internet-scale attack surfaces once exploit details are public.1
Tracked as CVE-2026-32475, the flaw affects Elementor Pro versions up to and including 4.2.1. Wordfence rates it as a 9.8-severity unauthenticated arbitrary file upload vulnerability and says attackers can use it to upload executable PHP files, potentially leading to remote code execution and full site takeover.2 The patched version, Elementor Pro 4.2.2, was released on August 19, 2026.2
Administrators running Elementor Pro should immediately confirm that all sites are on version 4.2.2 or later. Updating closes the vulnerability, but it does not remove malicious files that may have been uploaded before the patch was applied.2
Security teams should review wp-content/uploads/elementor/forms/ for any .php files. Wordfence says the directory is intended for form uploads and should not contain PHP files; executable PHP there is a strong indicator of compromise.2
Teams should also inspect web server access logs for suspicious requests to /wp-admin/admin-ajax.php with the action parameter elementor_pro_forms_send_form, particularly when paired with multipart form uploads or unexpected file activity.2
The vulnerability is in Elementor Pro’s Forms functionality and depends on a published page containing an Elementor Pro Form widget with at least one non-required File Upload field.2 In that configuration, an unauthenticated attacker can exploit a validation bypass to upload a file type that should normally be blocked, including PHP.2
Tenable’s CVE record describes CVE-2026-32475 as an unrestricted upload of a dangerous file type affecting Elementor Pro through version 4.2.1.3
Security teams should prioritize these checks:
.php file in wp-content/uploads/elementor/forms/./wp-admin/admin-ajax.php using elementor_pro_forms_send_form.Wordfence reported that attackers began targeting the vulnerability on August 19, 2026, the same day it was publicly disclosed, and that its firewall had blocked more than 190,000 exploit attempts by September 2.2
WordPress plugins are attractive targets because they concentrate risk across many independently operated sites. A single flaw in a popular plugin can expose agencies, small businesses, e-commerce sites, publishers and nonprofits at the same time. Elementor Pro is used as a site-building tool, which means vulnerable functionality may sit directly on public-facing pages rather than behind administrative workflows.2
That makes exploitation easy to automate. Attackers can scan for WordPress sites, identify plugin-specific endpoints or form structures, and send exploit attempts at scale. Even when a patch is available, attackers often have a window because many WordPress environments depend on manual updates, paid plugin licenses, staging workflows or agency maintenance queues.
The lesson for web administrators is that “routine” site software should be treated as production attack surface. Plugins that accept uploads, process forms, manage users or modify site content deserve the same urgency as core server components when critical vulnerabilities are disclosed.
Security teams should treat vulnerable Elementor Pro deployments as potentially exposed if they were internet-facing on or after August 19, 2026. Patch first, then hunt for compromise.
If suspicious PHP files are found in the Elementor forms upload directory, remove the site from public access if necessary, preserve logs, rotate WordPress administrator credentials, review database users and scheduled tasks, and check the wider filesystem for persistence mechanisms.
Organizations managing multiple WordPress sites should also inventory Elementor Pro usage, verify license and update status, disable unnecessary upload fields, block PHP execution in upload directories where possible, and place form endpoints behind web application firewall rules that prevent executable file uploads.
Microsoft’s October 13 security release fixed more than 1,400 vulnerabilities, including one exploited zero-day and two publicly disclosed zero-days. For enterprise defenders, the priority is not reading every CVE first, but building a defensible triage order that moves exploited, exposed and business-critical systems to the front of the patch queue.
Google is opening a new path for U.S. adults to create private Android apps in Google AI Studio and run them through Google Play without publishing them in the public store. The change recasts Play as distribution infrastructure for personal software, while keeping policy, identity and future review gates in the path from prototype to public app.
American Express has introduced an Intent Intelligence Framework for agentic commerce, arguing that autonomous checkout needs a machine-readable record of what a customer approved, not only a payment credential. The proposed flow uses a Create Intent API, Intent ID, proof-of-intent token and scoped digital credential to help issuers, wallets, agents and merchants validate purchases before checkout.
Sophos made AI Defense generally available on October 13, framing the product as a real-time governance layer that discovers and controls employee and application use of AI tools. The launch reflects a broader shift in AI security from policy documentation to runtime enforcement across endpoint, network, identity and browser telemetry.
CVE
A Common Vulnerabilities and Exposures identifier used to track a publicly known security flaw.
CVSS
A scoring system used to rate vulnerability severity; higher scores generally indicate more urgent risk.
Remote code execution
A class of vulnerability that can let an attacker run commands or code on a target system.
Webshell
A malicious script placed on a web server to give attackers persistent remote control.
Comments