A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.
Elementor Pro is a popular WordPress plugin with more than 6 million active installations, allowing users to build websites using a drag-and-drop interface.
The CVE-2026-32475 vulnerability was patched on August 19. Since then, Defiant’s Wordfence web application firewall has blocked almost 200,000 exploitation attempts targeting its clients.
The issue stems from faulty validation of file-upload arrays in Elementor Pro forms and is present in versions 4.2.1 and earlier.
By submitting an empty file as the first array element and a malicious PHP file as the second, attackers can cause the plugin to stop validating subsequent files.
The uploaded payload is stored under /wp-content/uploads/elementor/forms/ and can then be accessed to execute commands remotely.
WordPress cybersecurity platform Patchstack warned last month that attackers could exploit it to upload arbitrary PHP files and trigger PHP code execution on the server.
Exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, a common configuration.
Yesterday, Wordfence alerted that activity exploiting CVE-2026-32475 started on August 19, the same day Elementor released version 4.2.2 that addressed the vulnerability.
“The attacker submits the form’s File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php filename, which is the structure that triggers the validation bypass,” Wordfence says.
Source: Wordfence
“Once written, the uploaded PHP file is placed in the /wp-content/uploads/elementor/forms/ directory under a randomly generated filename with the attacker-supplied .php extension, and the attacker can request it directly to execute arbitrary commands on the server,” the security firm notes.
Wordfence observed increased attack activity between August 19 and 23, reporting more than190,000 blocked exploitation attempts.
A list of IP addresses that launched thousands of attacks is also provided so that defenders can add them to their blocklists.
Administrators should upgrade to Elementor Pro 4.2.2 or later immediately and inspect the /wp-content/uploads/elementor/forms/ directory for rogue PHP files.
Since this location is used to store uploaded form submissions, the presence of a PHP file is a strong indicator of compromise that should trigger clean-up operations.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
