Since August 19, Defiant’s Wordfence web application firewall has blocked almost 200,000 attempts to exploit a critical flaw in the Elementor Pro WordPress plugin, according to public reporting on CVE-2026-32475.
How the flaw works: a file-upload validation bypass
The vulnerability, tracked as CVE-2026-32475, stems from faulty validation of file-upload arrays in Elementor Pro forms and affects versions 4.2.1 and earlier. Attackers submit the form’s File Upload field as an array in which the first element is empty and the second element carries a PHP payload with a .php filename; that structure “triggers the validation bypass,” Wordfence explains. Once written, the uploaded PHP file is placed in the /wp-content/uploads/elementor/forms/ directory under a randomly generated filename with the attacker-supplied .php extension, and the attacker can request it directly to execute arbitrary commands on the server.
Patch, timeline, and observed activity
Elementor released version 4.2.2 on August 19 to address the flaw. Wordfence reports that exploitation activity began on the same day. Between August 19 and August 23, Wordfence recorded increased attack activity and reported more than 190,000 blocked exploitation attempts; across its clients the company has blocked almost 200,000 attempts since the patch was issued. Patchstack also warned last month that attackers could exploit the issue to upload arbitrary PHP files and trigger PHP code execution on the server.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWhere compromises appear and how they execute
Successful exploitation requires a published Elementor Pro Form widget that contains at least one File Upload field — a configuration the vendor describes as common. The uploaded payload is stored under /wp-content/uploads/elementor/forms/; because that directory is intended for form submissions, “the presence of a PHP file is a strong indicator of compromise,” the reporting notes. Attackers who place a PHP file there can request it directly to execute arbitrary commands on the hosting server, effectively achieving remote code execution.
Immediate steps for Elementor Pro users, site administrators, and security teams
- Administrators should upgrade to Elementor Pro 4.2.2 or later immediately, the advisory says.
- Inspect the /wp-content/uploads/elementor/forms/ directory for rogue PHP files; because the directory stores form submissions, a PHP file’s presence should trigger clean-up operations.
- Security operators using Wordfence or other WAF solutions can apply IP blocklists; Wordfence published a list of IP addresses that launched thousands of attacks to help defenders add them to blocklists.
Adversaries, defenders, and the broader signal
For attackers, the flaw provides a straightforward path: supply a crafted file array to bypass validation and drop a PHP webshell into a predictable uploads directory. For defenders, the incident underscores the gap between initial prevention and post-compromise control. The reporting cites the Blue Report 2026 to note that “overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, reflecting that context.
Elementor Pro remains widely used, and the presence of published forms with File Upload fields on many sites makes attack opportunities numerous until sites are patched. Administrators who cannot immediately patch should at minimum scan the specified uploads directory and enable monitoring to detect and remove unexpected PHP files.
Link to the original story: https://www.bleepingcomputer.com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/
