Elementor Pro Flaw Exploited in the Wild

A month after a critical vulnerability was patched in Elementor Pro, a widely used WordPress plugin, attackers are actively exploiting it to upload malicious PHP payloads and take over websites. WordPress security firm Defiant reports that it has blocked over 190,000 exploit attempts related to this flaw, which allows unauthenticated users to execute arbitrary code on vulnerable servers.

A Bug in the Validation Loop

The vulnerability, tracked as CVE-2026-32475 with a CVSS severity score of 9.8, is described as an arbitrary file upload issue in the function that handles form submissions. Elementor Pro, the paid iteration of the free Elementor plugin, offers additional features, including a Form widget with support for file upload fields.

According to Defiant's analysis, the root cause lies in how the plugin processes multiple file uploads submitted through the same form field. When the validation loop encounters an upload slot marked as empty, it triggers an error and returns, aborting the validation of other files in the field.

The intended behavior would be to skip the empty entry and continue validating the remaining files. Instead, the flaw allows an attacker to submit an upload field as an array with two parts: an empty slot that triggers the early return, followed by a file containing a PHP payload that bypasses validation checks. Because the field processing function correctly skips the empty slot and processes the second part of the array, the malicious file is written to disk without any security checks.

Unauthenticated Code Execution

The consequence of this flaw is severe. “As a result, an unauthenticated attacker can request the uploaded file to execute their PHP payload on the server,” Defiant explains, noting that this could lead to full site compromise.

Successful exploitation writes a PHP file to the /wp-content/uploads/elementor/forms/ directory, which normally stores uploaded form submissions. An attacker who gains such a foothold can then escalate privileges, install backdoors, deface the site, or leverage the compromised server for further attacks.

Patch Released in August

Elementor Pro versions up to and including 4.2.1 are affected by CVE-2026-32475. The patched version, 4.2.2, was released on August 19. Defiant urges site owners to update to the fixed iteration as soon as possible to mitigate the risk.

The security firm notes that Elementor Pro has over 6 million active installations, but the number of affected sites remains unclear. As of September 4, according to WordPress data, approximately two-thirds of Elementor’s 10 million installations run a vulnerable version of the plugin.

Immediate Exploitation After Patch

Defiant reports that threat actors started exploiting the vulnerability immediately after the fixes were published. The rapid exploitation underscores the importance of timely updates, as attackers often reverse-engineer patches to develop exploits for unpatched systems.

Since then, Defiant has blocked more than 190,000 exploit attempts. The firm's threat intelligence team has been monitoring the situation and providing guidance to affected users.

Indicators of Compromise

Site administrators are advised to check the /wp-content/uploads/elementor/forms/ directory for the presence of any PHP file, which is a strong indicator of compromise (IoC). A file in that directory that is not an image or other expected upload type could signal that the site has been successfully attacked.

Defiant also recommends reviewing server logs for requests to /wp-admin/admin-ajax.php, which may indicate exploit attempts. If any evidence of compromise is found, administrators should check their sites for backdoors and take appropriate remediation steps, such as cleaning the infected files and rotating credentials.

Wider Context

This incident is part of a series of vulnerabilities affecting WordPress plugins. Related coverage from SecurityWeek includes a 12-year-old PostgreSQL vulnerability that enables database and server takeover, VMware Workstation and Fusion updates that patch a critical vulnerability, and Google patching its sixth Chrome zero-day of 2026.

More than a security concern, this active exploitation shows that plugin vulnerabilities continue to be a major attack vector for internet-facing websites. The scale of Elementor’s installation base—over 10 million—makes it an attractive target for attackers seeking to compromise large numbers of sites in a single campaign.

Why It Matters

The swift exploitation of this flaw underscores the risk that unpatched plugins pose to WordPress sites. With two-thirds of Elementor installations potentially running a vulnerable version, the window for attackers is wide, and the consequences for site owners—from data theft to full compromise—are significant.

This incident also highlights the importance of not just patching, but actively monitoring for signs of intrusion. Even with a patch available, the attack surface remains large, and sites that have already been compromised may need thorough cleanup to remove backdoors and other malicious artifacts. For administrators, the advice is clear: update immediately, inspect upload directories for suspicious files, and review logs for indicators of attack.