Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
A critical vulnerability in the Elementor Pro WordPress plugin has been actively exploited by threat actors, allowing them to upload and execute PHP code on vulnerable websites. The vulnerability, patched in version 4.2.2, stems from an arbitrary file upload issue, and security firm Defiant has blocked over 190,000 exploit attempts. Site owners should immediately update to version 4.2.2 or later to mitigate the risk of full site compromise.
A critical vulnerability in the Elementor Pro WordPress plugin has been actively exploited by threat actors, allowing them to upload and execute PHP code on vulnerable websites. The bug, tracked as CVE-2026-32475 (CVSS score of 9.8), is described as an arbitrary file upload issue in the function that handles form submissions.
While submissions are passed through the plugin’s validation and processing mechanisms, when the validation loop encounters an upload slot marked as empty, it triggers an error and returns, aborting the validation of other files in the field. An attacker can submit an upload field as an array with two parts: an empty slot that triggers the return, followed by a PHP payload that is uploaded without validation.
Because the function that handles field processing correctly skips the empty slot and processes the second, unvalidated part of the field, the attacker-supplied file is written to disk. “As a result, an unauthenticated attacker can request the uploaded file to execute their PHP payload on the server,” Defiant explains, noting that this could lead to full site compromise.
CVE-2026-32475 impacts all Elementor Pro plugin versions up to 4.2.1 and was patched in version 4.2.2 on August 19. Site owners should update to the fixed iteration as soon as possible. According to WordPress data, approximately two-thirds of Elementor’s 10 million installations run a vulnerable plugin version as of September 4.
Defiant notes that Elementor Pro has over 6 million active installations, but it is unclear how many of them are affected. The security firm has blocked over 190,000 exploit attempts to date. Successful exploitation of the vulnerability results in a PHP file being written to the /wp-content/uploads/elementor/forms/ directory, which stores uploaded form submissions.
Site administrators are advised to check the directory for the presence of any PHP file, which is a strong indicator of compromise (IoC). They should also check logs for requests to /wp-admin/admin-ajax.php and check their sites for backdoors if any evidence of compromise is discovered.