Actively Exploited Elementor Pro Flaw Enables Webshell Uploads and Remote Commands
Summary
CVE-2026-32475 affects Elementor Pro 4.2.1 and earlier. Attackers bypass file-upload validation to upload PHP payloads and run commands. Wordfence reports nearly 200,000 blocked attempts; upgrade to 4.2.2 or later and check for rogue PHP files.
Key points
- The flaw affects Elementor Pro 4.2.1 and earlier and was patched in version 4.2.2, released August 19.
- Attackers bypass file-upload validation by submitting an empty file first and a PHP payload second.
- The uploaded payload is stored in /wp-content/uploads/elementor/forms/ and can be requested to execute commands remotely.
- Exploitation requires a published Elementor Pro Form widget with at least one File Upload field.
- Defiant’s Wordfence reports blocking nearly 200,000 exploitation attempts since August 19, with increased activity from August 19 to 23.
- Administrators should upgrade to Elementor Pro 4.2.2 or later and inspect the uploads directory for rogue PHP files; the article says PHP files there are a strong indicator of compromise.
Article Details
- Vulnerability Types
- Improper validation of file-upload arrays enabling PHP file upload and remote command execution
- Severity
- Critical
- Affected Versions
- Elementor Pro 4.2.1 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade to Elementor Pro 4.2.2 or later.
- Inspect /wp-content/uploads/elementor/forms/ for rogue PHP files and clean them up.
MITRE ATT&CK
T1059.004 · Unix ShellThe uploaded PHP file can be requested to execute arbitrary commands on the server.T1105 · Ingress Tool TransferAttackers submit a PHP payload through an Elementor Pro form and upload it to the server.T1505.003 · Web ShellThe vulnerability is exploited to upload PHP webshells to WordPress servers.
CVE
Vendors
Products
Elementor Pro for WordPressA critical vulnerability in Elementor Pro, tracked as CVE-2026-32475, is being actively exploited to upload webshells and run arbitrary commands on WordPress servers.PatchstackWordPress cybersecurity platform Patchstack warned last month that attackers could exploit it to upload arbitrary PHP files and trigger PHP code execution on the server.WordfenceDefiant’s Wordfence has blocked nearly 200,000 attempts since the patch on August 19, and administrators should upgrade to Elementor Pro 4.2.2 or later and inspect the uploads directory for rogue PHP files.WordPressA critical vulnerability in Elementor Pro, tracked as CVE-2026-32475, is being actively exploited to upload webshells and run arbitrary commands on WordPress servers.