Attackers Exploit Critical Elementor Pro File Upload Vulnerability
Summary
Attackers are exploiting CVE-2026-32475 in Elementor Pro to upload and execute PHP files on WordPress sites. Version 4.2.2 fixes the flaw; administrators should update and check for signs of compromise.
Key points
- CVE-2026-32475 is an unauthenticated arbitrary file upload vulnerability in Elementor Pro’s form submission handling, rated CVSS 9.8.
- Attackers can bypass file validation by submitting an empty upload slot followed by a PHP payload, which is then written to the server and can be executed.
- All Elementor Pro versions up to 4.2.1 are affected; version 4.2.2, released August 19, contains the fix.
- Defiant reports that exploitation began immediately after the fix was released and that it has blocked more than 190,000 exploit attempts.
- Administrators should update, check /wp-content/uploads/elementor/forms/ for PHP files, review requests to /wp-admin/admin-ajax.php, and look for backdoors if compromise is suspected.
- WordPress data indicated that about two-thirds of Elementor’s 10 million installations were running a vulnerable version as of September 4; the number of affected Elementor Pro installations is unclear.
Article Details
- Vulnerability Types
- Arbitrary file upload
- Severity
- Critical (CVSS 9.8)
- Affected Versions
- Elementor Pro versions up to 4.2.1
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Products
Elementor Pro for WordPressHackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns.WordPressHackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns.