Vendor

Elementor

0 mentions in 7 days · 5 in 30 days · 5 total · first seen Aug 20, 2026 · last 10d ago

Timeline5 articles

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.

Defiant warns that attackers are exploiting CVE-2026-32475 (CVSS 9.8), an unauthenticated arbitrary file upload flaw in the Elementor Pro WordPress plugin's form submission handling, which affects all versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Exploitation began immediately after the fix shipped, with Defiant blocking over 190,000 exploit attempts to date; roughly two-thirds of Elementor's 10 million installations still ran a vulnerable version as of September 4. Successful exploitation writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/ and can lead to full site compromise; administrators should check that directory for PHP files and review requests to /wp-admin/admin-ajax.php.

SecurityWeekSep 5, 13:00 UTC · 10d agoExploit / PoC in the wildCVE-2026-32475

Elementor Pro RCE Flaw Under Active Attack

A critical Elementor Pro Forms module flaw allowing unauthenticated file uploads is under active attack against widely used WordPress sites.

A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload arbitrary files through the plugin's Forms module. The SOCRadar report indicates the flaw is being actively exploited in the wild. No CVE identifier was provided in the available text.

SOCRadarSep 4, 13:34 UTC · 11d agoExploit / PoC in the wild

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker NewsSep 4, 08:48 UTC · 11d agoExploit / PoC in the wildCVE-2026-14894 CVE-2026-32475

Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin

Attackers actively exploit a critical unauthenticated file upload flaw in Elementor Pro (6M+ installs), enabling remote code execution and site takeover.

Wordfence reports that attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in Elementor Pro, which it disclosed on August 19, 2026. The WordPress plugin has more than 6,000,000 active installations. Unauthenticated attackers can upload arbitrary files, including executable PHP files, leading to remote code execution and complete site takeover.

WordfenceSep 2, 15:07 UTC · 13d agoExploit / PoC in the wild

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.

Patchstack researcher Tin Pham reported an unrestricted file upload flaw in Elementor Pro's Forms module (CVE-2026-32475, CVSS 9.0), affecting all versions up to and including 4.2.1. Submitting two file parts for one field bypasses the extension blocklist and writes attacker-controlled PHP into a public uploads directory, yielding unauthenticated remote code execution when a published Elementor page uses a Form widget with a File Upload field. A patched version 4.2.2 shipped August 19, 2026, a day after WordPress 7.0.4 fixed CVE-2026-65640 (CVSS 8.8), an RCE via Postscript file upload when Imagick and Ghostscript are in use.

The Hacker NewsAug 20, 06:04 UTC · 26d agoVulnerability CVE-2026-32475 CVE-2026-656401

Related CVEsby mentions

CVE-2026-324759.02%
Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild.
· Elementor Pro (WordPress plugin) All versions from n/a through 4.2.1 (i.e., every release up to and including 4.2.1)mass
CVE-2026-148949.85%
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed…
· WordPress—
CVE-2026-656408.82%
Author-Level RCE in WordPress Core via Malicious Postscript File Upload
WordPress core is vulnerable to remote code execution when a user with Author-level privileges or higher (holding the upload_files capability) uploads a malicious Postscript file that the server processes using the Imagick image library with Ghostscript. Exploitation requires two server prerequisites: Imagick must be in use and Ghostscript must be installed, and the attacker needs an account with upload rights, so unauthenticated attacks are not possible. A successful attacker gains code execution on the web server with high impact on confidentiality, integrity, and availability (CVSS 8.8). All versions of WordPress are affected; a fix shipped in WordPress 7.0.4 and was backported as a courtesy to all branches back to 4.7. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns a 1.9% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is documented.
· WordPress (core) All versions prior to the fix; fixed in 7.0.4, with the fix backported to all branches back to 4.7mass

Appears with

product WordPress 5 product Elementor Pro 5 vendor Automattic 2 vendor Patchstack 2 vendor Wordfence 2 organization Elementor 2 malware Mushr00w_upl.php 1 vendor WordPress 1 organization Defiant 1 organization Patchstack 1 organization Wordfence 1 product Super Forms 1 vendor Defiant 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.