Attackers Started Exploiting a Critical Elementor Pro Flaw the Same Day It Was Patched

Elementor shipped a fix for a critical, unauthenticated remote-code-execution flaw in Elementor Pro on August 19. Attackers did not wait to see who would update. According to WordPress security firm Wordfence, exploitation of the flaw began the same day the patch was released, and its web application firewall has since blocked nearly 200,000 attempts to abuse it.

The vulnerability, tracked as CVE-2026-32475, lets an attacker upload and execute arbitrary PHP code on a vulnerable site without logging in. Elementor Pro is the paid add-on for Elementor, one of WordPress’s most widely used drag-and-drop website builders. Wordfence puts Elementor Pro’s active installations at more than 6 million, and says it remains unclear how many of those sites are still running a vulnerable version.

How the Bypass Works

The bug lives in how Elementor Pro’s Form widget validates file uploads. When a form includes a File Upload field, submissions are supposed to pass through a validation and processing routine before anything is written to disk. According to Wordfence’s analysis, that routine has a flaw in how it walks through multiple files submitted in a single field.

An attacker submits the File Upload field as an array with two entries: an empty first element, followed by a second element carrying a malicious file with a .php extension. When the validation loop hits the empty first entry, it throws an error and returns immediately, aborting the check for the rest of the array instead of skipping past the empty slot and continuing. The form-processing code, however, still goes on to handle the second, now-unvalidated entry and writes it to disk.

The result is a PHP file saved into /wp-content/uploads/elementor/forms/, the directory Elementor Pro normally uses to store legitimate uploaded form submissions. Because that directory is web-accessible, an attacker can then request the file directly and get the server to execute it, achieving full remote code execution with no authentication required.

A Patch-Day Race Attackers Won

Elementor closed the hole in version 4.2.2, released August 19. That is also the exact day Wordfence says exploitation activity started, a pattern that has become routine for high-profile WordPress plugin flaws: publishing a patch effectively announces the vulnerability to anyone willing to diff the code, and mass scanning follows within hours. Wordfence recorded a spike in attack traffic between August 19 and 23, and has published a list of the IP addresses responsible so defenders can add them to blocklists.

As of this writing, CVE-2026-32475 has not been added to the CISA Known Exploited Vulnerabilities catalog, despite the confirmed in-the-wild activity. The National Vulnerability Database lists the flaw at a CVSS score of 9.0 (critical), attributing an attack that requires no privileges or user interaction but a high attack complexity, matching the original assessment from Patchstack, the firm that first disclosed the bug.

This is sxz.io’s second look at CVE-2026-32475. Our original coverage of the patch focused on the fix itself; this one covers what happened after it shipped.

What Site Owners Should Check

Wordfence and independent outlets covering the exploitation recommend the following steps for any site running Elementor Pro:

• Update to Elementor Pro 4.2.2 or later immediately if you have not already.
• Check the /wp-content/uploads/elementor/forms/ directory for any file with a .php extension. Since that directory is meant to store form submissions, not executable code, the presence of a PHP file there is a strong indicator of compromise.
• Review server logs for requests to /wp-admin/admin-ajax.php around the time any suspicious file was created.
• If a compromise is confirmed, do not stop at deleting the malicious file. SecurityWeek notes that administrators should check for backdoors more broadly once any evidence of compromise turns up, since an attacker who already achieved code execution may have planted more than one foothold.

The vulnerability only applies to sites that have published an Elementor Pro Form widget containing at least one File Upload field, but Wordfence notes that this is a common configuration on contact and application forms.

Why This Keeps Happening

Nearly three weeks passed between the patch and this round of coverage, and the exploitation itself started on day one. That gap is the real story: a fix being available does nothing for a site that has not applied it, and popular page-builder plugins like Elementor are exactly the kind of software that accumulates a long tail of unpatched installations, since many run on sites nobody actively maintains. Until a site owner updates, a published patch functions less like protection and more like a public map of exactly what to exploit.