Summary
- CVE-2026-32475 affects Elementor Pro through version 4.2.1 and can permit unauthenticated malicious file uploads.
- Exploitation requires a published Elementor Pro form containing a non-required file-upload field.
- Wordfence says it has blocked more than 190,000 attempts; Elementor Pro 4.2.2 contains the fix.
Attackers are actively exploiting a critical vulnerability in Elementor Pro that can allow unauthenticated users to upload executable files and potentially take control of vulnerable WordPress sites.
The flaw, CVE-2026-32475, affects Elementor Pro versions up to and including 4.2.1 and was fixed in version 4.2.2. Wordfence says its firewall has blocked more than 190,000 exploitation attempts since public disclosure.
The vulnerability sits in Elementor Pro’s form file-upload handling. When a particular upload field is submitted as an array and the first element indicates no file, a validation routine can return early instead of continuing to inspect the remaining elements.
A subsequent element can therefore escape the expected extension and file-type validation. An unauthenticated attacker can use the condition to upload an executable PHP file, creating a route to remote code execution and potentially complete control of the website.
The flaw is not reachable on every Elementor Pro installation. The target must have a published page containing an Elementor Pro Form widget with at least one File Upload field that is not marked as required.
That prerequisite reduces the exposed population compared with the plugin’s total installation base, but it does not eliminate the risk for sites using the affected form configuration. Wordfence says Elementor Pro has more than six million active installations.
The company said attackers began targeting CVE-2026-32475 on 19 August, the same day the flaw was publicly disclosed, with particularly heavy activity between 19 and 23 August. Its firewall had blocked more than 190,000 attempts by the time of its September update.
Those figures measure attempted exploitation rather than successful compromise. Large volumes of automated requests can include systems that are already patched, do not use the vulnerable configuration, or otherwise reject the attack.
The campaign nevertheless shows how rapidly public vulnerability information can be converted into broad internet scanning. WordPress plugins are particularly exposed to that dynamic because installation patterns can often be identified remotely and identical code is deployed across large numbers of independently administered sites.
The business consequences can also extend beyond the compromised website. WordPress installations frequently connect to marketing services, customer information, analytics platforms, email systems, and other web applications. Server-level access can therefore become a staging point for persistence, malicious redirects, credential theft, or further data access.
Maintenance responsibility is another complication. Marketing teams, external agencies, hosting providers, developers, and internal technology staff can each control different parts of a WordPress deployment. A patch can consequently exist while ownership of its emergency deployment remains unclear.
Version 4.2.2 closes the disclosed vulnerability, but updating cannot establish whether a site was compromised before the fix was installed. Where exploitation is already known to be widespread, historical server logs, unexpected files, administrative changes, and other evidence of persistence become part of the response.
The Elementor Pro campaign therefore combines two separate tasks: removing the vulnerable software state and assessing whether an attacker reached the system while that state was exposed. The first prevents the known path from being used again; the second determines whether remediation has arrived too late for a simple patch-only response.
