Elementor Pro File Upload Flaw Targeted in Attacks on WordPress Sites

Attackers are actively targeting a critical vulnerability in Elementor Pro, a widely used commercial WordPress website-building plugin, according to WordPress security firm Defiant.

The issue, tracked as CVE-2026-32475, carries a CVSS severity score of 9.8. It affects Elementor Pro versions through 4.2.1 and was addressed in version 4.2.2, released on August 19. Organizations using the plugin are urged to install the updated release promptly.

Validation bypass enables file uploads

The vulnerability is in the component responsible for processing file uploads submitted through Elementor Pro forms. Under certain conditions, an attacker can include an empty item in an upload field before a malicious file. The empty item causes the plugin's validation routine to stop before it evaluates later files in the request.

Although validation is interrupted, subsequent processing can still save the unchecked file to the server. An unauthenticated attacker could use this behavior to upload a PHP script and then access it remotely, potentially gaining the ability to run commands on the affected web server and take control of the site.

Defiant said exploitation began soon after the patch became available and that its systems had recorded more than 190,000 attack attempts. The company warned that successful attacks may leave PHP files in the /wp-content/uploads/elementor/forms/ directory, which is intended to store form-uploaded content.

Recommended response

• Upgrade Elementor Pro to version 4.2.2 or a later supported version.
• Review the Elementor forms upload directory for PHP or other unexpected executable files.
• Inspect web and application logs for suspicious requests involving /wp-admin/admin-ajax.php.
• If indicators are found, investigate for persistence mechanisms, backdoors, altered administrator accounts, and other signs of broader compromise.

Elementor's free plugin reports more than 10 million installations, while Elementor Pro has more than 6 million active deployments. Available WordPress telemetry indicated that a substantial share of installations were still running affected versions as of September 4, though the number of sites using the Pro edition and exposed form-upload functionality was not clear.