Critical Elementor Pro Vulnerability Being Used to Hijack WordPress Sites

A critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited by attackers: it lets them upload a web shell to the server, after which the attacker can execute arbitrary commands. Elementor Pro is one of the most widely used drag-and-drop site-building plugins, installed on more than 6 million sites.

How the Attack Works

The issue, assigned the identifier CVE-2026-32475, stems from improper array validation when files are uploaded through Elementor Pro forms. It affects versions 4.2.1 and earlier. The exploitation technique turned out to be deceptively simple: the attacker sends the file upload field as an array in which the first element is empty and the second contains a malicious PHP file. After that, the plugin stops validating the subsequent files.

The uploaded file is saved in the /wp-content/uploads/elementor/forms/ directory under a randomly generated name with a .php extension specified by the attacker. It can then be accessed directly to run arbitrary code on the server. The attack is only possible under one condition — the site must have a published Elementor Pro form with at least one file upload field. Unfortunately, this is a rather common configuration.

The Scale of Exploitation

The vulnerability was patched on August 19 with the release of version 4.2.2. According to Wordfence, a wave of attacks began that same day — the company recorded a peak in activity between August 19 and 23, blocking more than 190,000 exploitation attempts against its customers. In total, since the patch was released, the Wordfence firewall has fended off nearly 200,000 such requests. The Patchstack platform also warned of the risks: as early as last month, it noted that the vulnerability allows arbitrary PHP files to be uploaded and code execution to be achieved.

What Administrators Should Do

Wordfence has published a list of IP addresses from which thousands of attacks were launched — they can be added to blocklists. Administrators are strongly urged to update immediately to Elementor Pro 4.2.2 or a newer version and to check the /wp-content/uploads/elementor/forms/ directory for suspicious PHP files. Since this storage is intended for data uploaded through forms, any PHP file in it is a clear sign of compromise and a reason for urgent cleanup.

Source: Bleeping Computer