Elementor Pro flaw CVE-2026-32475 exploited since patch day

Validation that stops at the second file

The vulnerability tracked as CVE-2026-32475 stems from faulty validation of file arrays submitted through Elementor Pro forms. It is present in versions 4.2.1 and earlier of the plugin.

The attack mechanism is short to describe. The attacker submits the upload field as an array: the first element is empty, the second carries a PHP payload with a filename ending in .php. That structure is enough to halt validation of the files that follow. The file is then written to the /wp-content/uploads/elementor/forms/ directory, under a randomly generated name but with the .php extension supplied by the attacker. All that remains is to request that address directly in order to run arbitrary commands on the server.

One condition narrows the scope: the site must have published an Elementor Pro Form widget containing at least one file upload field. According to Bleeping Computer, which reported the case on 3 September 2026, this configuration is common.

The patch and the attacks, on the same day

Elementor released version 4.2.2 on 19 August 2026, fixing the flaw. On 2 September, Wordfence — the web application firewall from the company Defiant — reported that exploitation activity against CVE-2026-32475 had begun on that same 19 August.

Since then, Wordfence says it has blocked close to 200,000 exploitation attempts aimed at its customers, of which more than 190,000 were concentrated in the 19 to 23 August window. WordPress security platform Patchstack, for its part, had warned last month that an attacker could upload arbitrary PHP files and trigger code execution on the server.

The overlap between the release of the patch and the start of the attacks is no coincidence: a patch makes public the description of the defect it repairs. The delay that matters, then, is not the vendor’s, but the one separating a patch being made available from its actual installation on each site.

Six million installations concerned

Elementor Pro claims more than six million active installations. The plugin lets you build WordPress sites by drag and drop, which explains its presence on a large number of sites run by small teams, or even by a single person with no particular security expertise. Those are precisely the installations that receive their updates last.

What you need to check now

The recommendation comes down to two actions. First, move immediately to Elementor Pro 4.2.2 or later. Second, inspect the /wp-content/uploads/elementor/forms/ directory for PHP files.

That second point deserves emphasis: this location exists to store files submitted through forms. The presence of a PHP file there is therefore a serious indicator of compromise, and one that must trigger cleanup work — updating the plugin does not remove a webshell that has already been dropped.

Wordfence has also published a list of the IP addresses behind thousands of attacks, so that defenders can add them to their blocklists.

Between 19 and 23 August, the gap between a patch released and a patch applied was measured in tens of thousands of attempts per day. If your site uses an Elementor form with uploads, checking the forms directory cannot wait.