A newly patched critical vulnerability (CVE‑2026‑32475) in the Elementor Pro plugin is being abused to upload webshells and execute arbitrary commands on WordPress servers. Wordfence has blocked nearly 200,000 attempts, but site owners must upgrade immediately.

  • CVE-2026-32475 triggered over 200,000 exploitation attempts
  • Patch released August 19; upgrade to Elementor Pro 4.2.2 or later immediately
  • File‑upload form validation bypass allows malicious PHP webshells

Elementor Pro, with more than 6 million active installations, lets users build sites via a drag‑and‑drop interface. The recently disclosed CVE‑2026‑32475 flaw exposes the plugin to remote code execution (RCE), enabling attackers to place and run arbitrary PHP files on the server.

Technical Details of the Bug

The vulnerability resides in improper validation of file‑upload arrays in Elementor Pro forms (versions 4.2.1 and earlier). By submitting an empty file as the first array element and a malicious PHP file as the second, the plugin stops validating subsequent files. The payload is stored under /wp-content/uploads/elementor/forms/ and can be accessed directly to run commands.

Read Also:CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

Patch and Industry Response

Elementor addressed the issue on August 19 with version 4.2.2. Defiant’s Wordfence firewall has blocked almost 200,000 exploitation attempts since then and published a list of offending IP addresses for administrators to block.

Why This Matters

BozokMedia analysis shows that because Elementor Pro is so widely deployed, this flaw puts millions of WordPress sites at risk, especially those using a Form widget with a File Upload field.

"File‑validation bypass is a classic yet dangerous technique; unpatched sites must apply the patch immediately," says cyber‑security expert Dr. Anita Sharma.

Historical Background

WordPress plugins have repeatedly been the source of high‑impact RCE bugs, such as the 2023 Avada theme flaw and the 2024 Langflow vulnerability. These incidents underscore the need for rigorous code audits and rapid patch cycles in the open‑source ecosystem.

Did You Know?: Elementor Pro was first released in 2016 and has since become one of the most downloaded page builders for WordPress.

Frequently Asked Questions

Q1: Can removing the vulnerable plugin version fix the issue?

A: Yes, all users should upgrade to version 4.2.2 or later and delete any .php files found in the /wp-content/uploads/elementor/forms/ directory.

Q2: Does the bug affect sites that do not use a file‑upload field in Elementor forms?

A: No, the exploit requires at least one File Upload field in a published Elementor Pro Form widget; sites without this configuration are not vulnerable to this specific bypass.