# Elementor Pro’s unauthenticated file-upload flaw is now being actively exploited Attackers are exploiting CVE-2026-32475 against Elementor Pro sites that expose a vulnerable Form upload field, turning an unauthenticated validation bug into a path for executable PHP uploads and full WordPress compromise. Version 4.2.2 contains the fix. The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads. - Status: Active - Published: 2026-09-09T20:33:05+12:00 - Updated: 2026-09-09T20:33:05+12:00 - Categories: Web Development, WordPress - Tags: CVE-2026-32475, cybersecurity, Elementor Pro, remote code execution - Canonical HTML: https://beyondthe.news/dossiers/elementor-pro-cve-2026-32475-active-exploitation-file-upload-rce ## What changed CVE-2026-32475 was patched in Elementor Pro 4.2.2 on August 19, 2026, but active exploitation is now established. Wordfence reported that attackers began targeting vulnerable sites the same day the issue was publicly disclosed and said its firewall had blocked more than 190,000 exploitation attempts by its September 2 update. The flaw affects Elementor Pro 4.2.1 and earlier and can let an unauthenticated attacker bypass file validation in certain Form widget configurations, upload executable PHP and potentially take control of the site. Independent security reporting has confirmed exploitation activity and public proof-of-concept material is circulating. ## Why it matters Elementor Pro is installed on millions of WordPress sites, and the vulnerable condition can sit in an ordinary public-facing form rather than an administrative interface. Once exploitation is active, simply knowing that a patch exists is not enough: operators need to verify the deployed plugin version, look for signs that a web shell was already uploaded and prevent PHP execution in upload directories where their stack permits it. The event also illustrates why WordPress plugin inventory and automated patch visibility matter as much as core-version hygiene. ## The bug can turn an optional form upload into code execution The vulnerable validation loop can stop checking remaining files in a multi-file upload when an earlier array element reports no file. On a published Elementor Pro Form widget with at least one non-required File Upload field, an unauthenticated request can therefore reach a path where a later malicious file is not correctly rejected. If the server executes PHP from the resulting upload location, that can become remote code execution. ## The remediation boundary is concrete: 4.2.2 or later Elementor released the patched 4.2.2 build on August 19. Sites on 4.2.1 or earlier are affected. Operators should verify the version actually running on each production site rather than assuming a control panel or staging environment updated successfully. ## Active exploitation changes the response from patching to incident checking Wordfence says exploitation began on the day of public disclosure and reported more than 190,000 blocked attempts. Independent reporting describes web-shell delivery and command execution. A site that remained exposed after disclosure should therefore be checked for unexpected PHP files, administrator accounts, modified plugins/themes and suspicious requests rather than treated as clean merely because it has now been updated. ## Firewall coverage is useful but configuration still matters Wordfence says its malicious-file-upload protection can block exploitation, and separately recommends disabling code execution in WordPress upload directories. That is defense in depth, not a replacement for installing the fixed Elementor Pro release. Other WAF products and hosting controls should be evaluated against the actual exploit pattern rather than assumed to provide equivalent protection. ## Key details - The vulnerability is CVE-2026-32475. - Elementor Pro versions through 4.2.1 are affected. - Elementor Pro 4.2.2 contains the fix. - The flaw is an unauthenticated arbitrary-file-upload vulnerability that can lead to remote code execution. - The vulnerable path requires a published Elementor Pro Form widget with at least one non-required File Upload field. - Wordfence says attackers began targeting the issue on August 19, 2026, the day of public disclosure. - Wordfence reported more than 190,000 blocked exploit attempts by its September 2 active-exploitation update. - Independent security reporting confirms the flaw is being used to upload web shells and execute commands. - Public proof-of-concept material is available. ## Builder takeaways - Update Elementor Pro to 4.2.2 or later immediately on every production site, including forgotten microsites and client installs. - If a site was exposed after August 19, perform compromise checks instead of assuming the patch retroactively makes it safe. - Search upload locations for executable files and review web-server/WAF logs for suspicious requests around Elementor form submission endpoints. - Prevent PHP execution in upload directories where your host/server configuration supports that hardening. - Keep an inventory of commercial WordPress plugins whose updates may not flow through the same automation as WordPress.org packages. - Do not combine this incident with unrelated WordPress plugin vulnerabilities just because they share an exploitation technique; patch and investigate each affected product separately. ## What to watch - Whether CISA or other national vulnerability catalogs add CVE-2026-32475 to exploited-vulnerability lists. - Updated attack telemetry and observed post-exploitation behavior. - Whether hosts or Elementor publish additional indicators of compromise or automated cleanup guidance. - How quickly the vulnerable installed base moves to 4.2.2 or later. ## Uncertainties - Wordfence’s exploit-attempt count reflects traffic observed and blocked by its own security products, not the total number of internet-wide attacks or confirmed compromises. - Not every site running an affected Elementor Pro version is exploitable; the public form configuration and server execution environment matter. - A blocked attempt count does not establish how many sites were successfully compromised. ## Sources - [Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin](https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/) — Wordfence · primary security telemetry · 2026-09-02T00:00:00+12:00. Primary source for exploitation timing, affected versions, patch boundary and Wordfence-blocked attempt count. - [Critical Elementor Pro flaw exploited to take over WordPress sites](https://www.bleepingcomputer.com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/) — BleepingComputer · independent security reporting · 2026-09-03T00:00:00+12:00. Independent confirmation of active exploitation, web-shell behavior and patch status. - [Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws](https://thehackernews.com/2026/09/over-440000-exploit-attempts-target.html) — The Hacker News · independent security reporting · 2026-09-04T00:00:00+12:00. Independent confirmation of active exploitation and context distinguishing the two plugin campaigns.