Attackers exploit critical Elementor Pro flaw to seize WordPress sites
CVE-2026-32475 lets attackers slip PHP webshells past form upload validation on a plugin with more than 6 million installs.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
A recently patched critical vulnerability in the Elementor Pro plugin for WordPress, tracked as CVE-2026-32475, is being exploited to drop webshells and execute arbitrary commands on servers, BleepingComputer reported. Elementor Pro has more than 6 million active installations. The flaw was patched on August 19, and since then Defiant's Wordfence web application firewall has blocked almost 200,000 exploitation attempts against its clients. The Hacker News separately reported over 440,000 exploit attempts targeting remote code execution flaws in Super Forms and Elementor Pro. The bug stems from faulty validation of file-upload arrays in Elementor Pro forms and affects versions 4.2.1 and earlier. By submitting an empty file as the first array element and a malicious PHP file as the second, an attacker can make the plugin stop validating subsequent files. The uploaded payload lands in the plugin's forms upload directory, where it can be accessed to run commands remotely. Exploitation requires a published Elementor Pro Form widget with at least one File Upload field, which BleepingComputer describes as a common configuration. Patchstack warned last month that the flaw could be used to upload arbitrary PHP files, and Wordfence said exploitation activity began on August 19. Site owners running affected versions should update immediately and inspect their upload directories for unexpected PHP files.