Attackers are already exploiting a critical vulnerability in Elementor Pro, a popular page builder plugin for WordPress. On 2 September the security company Wordfence said its firewall had already blocked over 190,000 attempts. Websites with a form that accepts file uploads are the ones at risk.
What happened?
The flaw is tracked as CVE-2026-32475. Patchstack disclosed it on 19 August, the same day Elementor released the fix in version 4.2.2. Every version up to and including 4.2.1 is vulnerable.
The bug is in how the form’s file upload field checks what it receives. If an attacker sends an empty entry followed by a PHP file in the same field, the file type check is skipped. The file is saved on the server and can then be run like the site’s own code. In practice, a stranger who is not logged in can run commands on your server and take over the site.
Scores differ slightly, but everyone agrees the flaw is critical. Patchstack rates it 9.0 out of 10 (CVSS v3.1), and Wordfence rates it 9.8.
When did the attacks start?
According to Wordfence, the first attacks came on 19 August, the day the fix was published, with the heaviest activity between 19 and 23 August. On 20 August BleepingComputer still reported no known attacks. The exploitation only became public knowledge on 2 September.
That gap matters. A site that was not updated in August has been exposed for two weeks, so updating now is not enough on its own. You also need to check whether anyone got in during that time.
Is your website at risk?
Wordfence counts more than 6 million active installations of Elementor Pro. The attack needs a published page with an Elementor Pro form that includes a file upload field, the kind used to send a CV, a drawing or a photo. The form identifiers are visible in the page’s public code, so attackers do not have to guess.
The sources describe the conditions differently. Wordfence says one file upload field that is not marked as required is enough, and fields are not required by default. Elementor told BleepingComputer that only forms with the multiple file upload option enabled are at risk, and that option is off by default. If your site has any form with a file upload field, assume it is at risk.
What to do now
- Update Elementor Pro to 4.2.2 or later. Check that your licence is still active: a Pro plugin with an expired licence may not receive updates automatically.
- Check the forms upload folder. The folder
/wp-content/uploads/elementor/forms/should never contain PHP files. Wordfence calls any PHP file there a strong indicator of compromise. - Ask your hosting provider to block PHP execution in the uploads folder. Then a file slipped in through a future flaw still cannot run.
- Have your IT partner review the server logs. Wordfence has published the IP addresses most active in these attacks and the requests to look for.
- If you find a suspicious file, do not just delete it. The attacker may have left other back doors. Restore the site from a clean backup and change the admin passwords. A break-in can be reported to CERT-EE, Estonia’s national computer emergency response team, at cert@cert.ee. If CVs or other personal data sent through the form may have been exposed, the 72-hour notification to the Data Protection Inspectorate may also apply. Our incident page lists the first steps.
If you are not sure which plugins and versions your website runs, a website security check will tell you.
Sources
- Wordfence: Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
- Patchstack: Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
- NVD: CVE-2026-32475
- BleepingComputer: Critical Elementor Pro bug exposes WordPress sites to RCE attacks
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
