Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.
Defiant warns that attackers are exploiting CVE-2026-32475 (CVSS 9.8), an unauthenticated arbitrary file upload flaw in the Elementor Pro WordPress plugin's form submission handling, which affects all versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Exploitation began immediately after the fix shipped, with Defiant blocking over 190,000 exploit attempts to date; roughly two-thirds of Elementor's 10 million installations still ran a vulnerable version as of September 4. Successful exploitation writes attacker-controlled PHP files to /wp-content/uploads/elementor/forms/ and can lead to full site compromise; administrators should check that directory for PHP files and review requests to /wp-admin/admin-ajax.php.
- CVE-2026-32475 (CVSS 9.8): unauthenticated arbitrary file upload triggered by a validation-loop bug in Elementor Pro form uploads.
- Exploitation started immediately after the August 19 patch; Defiant has blocked more than 190,000 exploit attempts.
- Successful attacks write PHP files to /wp-content/uploads/elementor/forms/, enabling remote code execution and full site compromise.
- Roughly two-thirds of the plugin's 10 million installations remained vulnerable as of September 4; fixed in Elementor Pro 4.2.2.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-32475 | Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild. Do: Update Elementor Pro to the latest patched release (any version after 4.2.1 — the data does not name a fixed build, so apply the newest available update). Until then, use WAF rules to block unauthenticated upload attempts to Elementor endpoints, restrict or disable modules that accept file uploads from unauthenticated users, and hunt for unexpected .php files under wp-content/uploads plus new admin users or modified content as signs of compromise. The high attack complexity (AC:H) means not every install may be exploitable, but patching should be treated as urgent given the reported mass exploitation. | 9.0 | 2% |
| mass≈1,000,000+ WordPress sites (Elementor Pro is the paid add-on to a page builder whose free core has 10M+ active installs) |
Full article444 words · extracted from securityweek.com · click to collapse
Hackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns.
A highly popular drag-and-drop website builder, Elementor is a free WordPress plugin with over 10 million installations. Elementor Pro is the paid version that offers additional features, including a Form widget with support for File Upload fields.
The bug, tracked as CVE-2026-32475 (CVSS score of 9.8), is described as an arbitrary file upload issue in the function that handles form submissions.
While submissions are passed through the plugin’s validation and processing mechanisms, when the validation loop encounters an upload slot marked as empty, it triggers an error and returns, aborting the validation of other files in the field.
The normal behavior would be to continue, skipping the empty entry, but the vulnerability results in checks never being applied to the remaining files uploaded through the same form field.
An attacker can submit an upload field as an array with two parts: an empty slot that triggers the return, followed by a PHP payload that is uploaded without validation.
Advertisement. Scroll to continue reading.
Because the function that handles field processing correctly skips the empty slot and processes the second, unvalidated part of the field, the attacker-supplied file is written to disk.
“As a result, an unauthenticated attacker can request the uploaded file to execute their PHP payload on the server,” Defiant explains, noting that this could lead to full site compromise.
CVE-2026-32475 impacts all Elementor Pro plugin versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Site owners should update to the fixed iteration as soon as possible.
According to Defiant, threat actors started exploiting the security defect immediately after the fixes landed. The security firm has blocked over 190,000 exploit attempts to date.
Successful exploitation of the vulnerability results in a PHP file being written to the /wp-content/uploads/elementor/forms/ directory, which stores uploaded form submissions.
Site administrators are advised to check the directory for the presence of any PHP file, which is a strong indicator of compromise (IoC). They should also check logs for requests to /wp-admin/admin-ajax.php and check their sites for backdoors if any evidence of compromise is discovered.
Defiant notes that Elementor Pro has over 6 million active installations, but it is unclear how many of them are affected. According to WordPress data, approximately two-thirds of Elementor’s 10 million installations run a vulnerable plugin version as of September 4.
Related: 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover
Related: VMware Workstation and Fusion Updates Patch Critical Vulnerability
Related: Google Patches 6th Chrome Zero-Day of 2026
Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/