As reported by BleepingComputer, a critical vulnerability in the Elementor Pro WordPress plugin is under active mass exploitation, with Wordfence blocking nearly 200,000 attack attempts since the patch dropped on August 19, 2026. This is not a theoretical risk — webshells are being deposited on real production sites.
Vulnerability Profile
| Field | Detail |
|---|---|
| CVE | CVE-2026-32475 |
| CVSS / Severity | Critical (exact score pending NVD confirmation) |
| Affected Product | Elementor Pro (WordPress plugin) |
| Affected Versions | 4.2.1 and earlier |
| Patched Version | 4.2.2 (released August 19, 2026) |
| Exploitation Status | Active in the wild — mass scanning and targeted attacks confirmed |
| Attack Volume | 190,000+ attempts blocked by Wordfence between Aug 19–23 |
| Exploitable Condition | Published Elementor Pro Form widget with at least one File Upload field |
Why This Matters
The technical root cause is a classic but devastating PHP array-handling flaw. By submitting the File Upload field as an array where the first element is empty, the plugin's validation logic short-circuits and fails to inspect the second element — a malicious .php file. The payload lands in /wp-content/uploads/elementor/forms/ under a random filename with an attacker-controlled extension. Requesting that file directly yields remote code execution.
The blast radius is significant. Elementor Pro runs on over 6 million WordPress installations, and the Form widget with file upload functionality is a mainstream configuration — contact forms, job applications, document submission portals. Any organization running an unpatched instance with that widget exposed is a sitting target. Successful exploitation gives attackers a webshell, which is typically the first step toward credential theft, defacement, SEO spam injection, or pivot into the broader hosting environment.
The speed of exploitation post-disclosure is the real story here. Attackers weaponized this within hours of the patch release, scanning for sites that hadn't yet updated. The window between patch availability and attacker adoption has effectively collapsed.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Patch now: Upgrade Elementor Pro to version 4.2.2 or later. Verify the update applied successfully in the WordPress admin.
- Hunt for webshells: Inspect
/wp-content/uploads/elementor/forms/for any.phpfiles. Any PHP file in this directory is a strong indicator of compromise. Remove immediately and investigate further. - Block known attacker IPs: Wordfence published a list of IPs launching thousands of attacks. Add these to your WAF or server-level blocklists.
- Review access logs: Look for POST requests to pages containing Elementor forms with anomalous file upload payloads — specifically array-structured multipart submissions.
- Disable file uploads temporarily: If patching must wait, remove File Upload fields from published Elementor forms as a stopgap mitigation.
Hardening for the Future
- Restrict PHP execution in upload directories via
.htaccessor nginx config — this single control would have neutralized this entire attack class - Implement WAF rules that inspect multipart form submissions for array-based file field manipulation
- Deploy automated WordPress patching and monitoring across all managed sites
- Conduct a full audit of all installed plugins for file upload functionality and apply the principle of least exposure
This incident reinforces a hard truth about the WordPress ecosystem: popular plugins with broad feature sets are high-value targets, and file upload functionality remains one of the most consistently exploited attack surfaces in web applications. Defenders should treat any plugin handling file uploads with heightened scrutiny — not just at patch time, but as part of continuous configuration review.
