Active Exploitation Follows Fast on the Heels of a Patch
A critical arbitrary file upload vulnerability in Elementor Pro, tracked as CVE-2026-32475 (CVSS 9.8), is being actively exploited to compromise WordPress sites just weeks after a patch shipped. WordPress security firm Defiant says it has already blocked over 190,000 exploit attempts, and that roughly two-thirds of Elementor's 10 million total installations were still running vulnerable code as of September 4, 2026.
What's Vulnerable
Elementor Pro is the paid tier of the widely used Elementor page-builder plugin, with over 6 million active installations. The flaw affects all versions up to 4.2.1; a fix landed in version 4.2.2, released August 19, 2026.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-32475 |
| CVSS Score | 9.8 (Critical) |
| Type | Arbitrary File Upload |
| Affected Versions | Elementor Pro ≤ 4.2.1 |
| Fixed Version | 4.2.2 |
How the Bug Works
The vulnerability lives in the function that handles Elementor form submissions. When the plugin's file-validation loop encounters an empty upload slot in a submitted array, it throws an error and returns immediately — skipping validation for every remaining file in that same field.
An attacker can abuse this by submitting a form upload array containing an empty entry followed by a malicious PHP payload. Because the validation loop bails out early on the empty slot, the PHP payload behind it is never checked, and it gets written unvalidated into /wp-content/uploads/elementor/forms/ — a web-accessible directory. From there, the attacker can request the uploaded file directly and achieve remote code execution on the server.
Active Exploitation
According to Defiant, attackers began exploiting the flaw immediately after the patch was released, reverse-engineering the fix to build a working exploit. The firm reports blocking more than 190,000 exploit attempts so far, and the pace suggests continued scanning and opportunistic attacks against sites that haven't yet updated.
Recommendations
- Update Elementor Pro to 4.2.2 or later immediately.
- Check the forms upload directory (
/wp-content/uploads/elementor/forms/) for unexpected PHP files. - Review server logs for suspicious requests to
/wp-admin/admin-ajax.phparound form-submission actions. - Deploy a WAF (Wordfence, Sucuri) if one isn't already in place — Defiant's blocking numbers suggest signature-based detection is already catching a meaningful share of attempts.
- Rotate credentials and check for backdoors on any site that ran a vulnerable version and shows signs of the indicators above.