Malicious actors launched massive attacks against Elementor Pro on the exact day developers published a critical vulnerability disclosure. This severe error within the popular WordPress extension allows attackers to upload executable PHP files without requiring a password. Consequently, they can execute arbitrary commands and ultimately seize total control of the compromised website. According to expert assessments by Wordfence, Elementor Pro currently operates on over 6 million active websites.
Understanding CVE-2026-32475
The critical vulnerability, tracked as CVE-2026-32475, specifically affects Elementor Pro version 4.2.1 and all preceding iterations. Wordfence assigned this vulnerability a staggering severity rating of 9.8 out of 10 on the CVSS scale. For a successful attack, the targeted website must publish an Elementor Pro form containing at least one optional “File Upload” field.
The File Validation Flaw
The root cause hides within the flawed validation process for uploaded files. Elementor Pro incorrectly processes the form field contents as an array. It sequentially verifies each individual element within that array. If an attacker submits an empty file as the primary element, the function detects the absence of data. Disastrously, it completely terminates the entire validation process instead of proceeding to the subsequent array element.
The attacker strategically places a malicious PHP file as the secondary element. The crucial security checks for file extensions and content types never reach this secondary file. However, a separate Elementor Pro function continues processing the array and ultimately saves the unverified file directly onto the server. As a result, the attacker successfully deploys a web shell and executes destructive commands possessing the privileges of the web server itself.
Infection and Execution Paths
The uploaded malicious file lands within the `/wp-content/uploads/elementor/forms/` directory under a randomly generated filename. Crucially, it retains the dangerous `.php` extension provided by the attacker. Upon directly accessing this specific file via a web browser, the server executes the embedded malicious code.
Rapid Exploitation and Mitigation
Developers released the essential fix within Elementor Pro version 4.2.2 on August 19th. Unfortunately, widespread attacks commenced that very same day. The most intense exploitation activity occurred between August 19th and August 23rd. Wordfence reports they have already successfully blocked over 190,000 distinct exploitation attempts targeting this vulnerability.
Security experts strongly advise all administrators to install Elementor Pro 4.2.2 or a newer version immediately. Furthermore, administrators must meticulously inspect the `/wp-content/uploads/elementor/forms/` directory. Any PHP file discovered within this specific folder constitutes a serious indicator of compromise. Finally, administrators should thoroughly examine web server logs for any suspicious requests targeting `/wp-admin/admin-ajax.php` utilizing the `elementor_pro_forms_send_form` parameter.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
