Elementor Pro flaw exposes WordPress sites to mass exploitation

A critical vulnerability in the Elementor Pro WordPress plugin is being exploited to compromise websites, showing how widely deployed plugins can quickly become internet-scale attack surfaces once exploit details are public.¹

Tracked as CVE-2026-32475, the flaw affects Elementor Pro versions up to and including 4.2.1. Wordfence rates it as a 9.8-severity unauthenticated arbitrary file upload vulnerability and says attackers can use it to upload executable PHP files, potentially leading to remote code execution and full site takeover.² The patched version, Elementor Pro 4.2.2, was released on August 19, 2026.²

What administrators should do now

Administrators running Elementor Pro should immediately confirm that all sites are on version 4.2.2 or later. Updating closes the vulnerability, but it does not remove malicious files that may have been uploaded before the patch was applied.²

Security teams should review wp-content/uploads/elementor/forms/ for any .php files. Wordfence says the directory is intended for form uploads and should not contain PHP files; executable PHP there is a strong indicator of compromise.²

Teams should also inspect web server access logs for suspicious requests to /wp-admin/admin-ajax.php with the action parameter elementor_pro_forms_send_form, particularly when paired with multipart form uploads or unexpected file activity.²

Affected configurations

The vulnerability is in Elementor Pro’s Forms functionality and depends on a published page containing an Elementor Pro Form widget with at least one non-required File Upload field.² In that configuration, an unauthenticated attacker can exploit a validation bypass to upload a file type that should normally be blocked, including PHP.²

Tenable’s CVE record describes CVE-2026-32475 as an unrestricted upload of a dangerous file type affecting Elementor Pro through version 4.2.1.³

Indicators of compromise

Security teams should prioritize these checks:

Any .php file in wp-content/uploads/elementor/forms/.
Requests to /wp-admin/admin-ajax.php using elementor_pro_forms_send_form.
Form upload submissions that include an empty file entry followed by a PHP payload.
Direct HTTP requests to newly created PHP files under the Elementor forms upload path.
Unexpected administrator accounts, webshell behavior, modified theme or plugin files, or outbound connections from the web server.

Wordfence reported that attackers began targeting the vulnerability on August 19, 2026, the same day it was publicly disclosed, and that its firewall had blocked more than 190,000 exploit attempts by September 2.²

Why plugin flaws scale quickly

WordPress plugins are attractive targets because they concentrate risk across many independently operated sites. A single flaw in a popular plugin can expose agencies, small businesses, e-commerce sites, publishers and nonprofits at the same time. Elementor Pro is used as a site-building tool, which means vulnerable functionality may sit directly on public-facing pages rather than behind administrative workflows.²

That makes exploitation easy to automate. Attackers can scan for WordPress sites, identify plugin-specific endpoints or form structures, and send exploit attempts at scale. Even when a patch is available, attackers often have a window because many WordPress environments depend on manual updates, paid plugin licenses, staging workflows or agency maintenance queues.

The lesson for web administrators is that “routine” site software should be treated as production attack surface. Plugins that accept uploads, process forms, manage users or modify site content deserve the same urgency as core server components when critical vulnerabilities are disclosed.

Recommended response

Security teams should treat vulnerable Elementor Pro deployments as potentially exposed if they were internet-facing on or after August 19, 2026. Patch first, then hunt for compromise.

If suspicious PHP files are found in the Elementor forms upload directory, remove the site from public access if necessary, preserve logs, rotate WordPress administrator credentials, review database users and scheduled tasks, and check the wider filesystem for persistence mechanisms.

Organizations managing multiple WordPress sites should also inventory Elementor Pro usage, verify license and update status, disable unnecessary upload fields, block PHP execution in upload directories where possible, and place form endpoints behind web application firewall rules that prevent executable file uploads.