Elementor Pro Flaw Actively Hijacking WordPress Sites

A critical vulnerability in the Elementor Pro plugin for WordPress is being actively exploited by attackers who want to seize control of vulnerable websites. Tracked as CVE-2026-32475, the flaw allows unauthenticated attackers to upload malicious PHP files and execute arbitrary commands on compromised servers. Elementor Pro is a widely used premium plugin that gives website owners a drag-and-drop interface for building pages, forms, and online stores. Because it powers so many businesses and e-commerce sites, a successful compromise can expose sensitive customer data and disrupt daily operations.

The plugin serves more than six million active WordPress installations, making it one of the most popular commercial extensions on the platform. Security researcher Tin Pham discovered the flaw and reported it to Patchstack, which relayed the findings to Elementor's development team on July 16. Elementor prepared a fix the following day, and Patchstack verified the patch on August 3 before it shipped publicly on August 19. The vulnerability affects all Elementor Pro versions released before 4.2.2, and administrators are strongly urged to update their installations immediately.

The vulnerability stems from a flaw in the File Upload module, which relies on two separate loops to validate and process submitted files. These loops handle empty file entries differently, creating a mismatch that attackers can exploit through a carefully crafted multipart upload request. By submitting an empty file as the first array element, followed by a malicious PHP file as the second, an attacker can bypass validation entirely. Patchstack explained that the validation routine exits after examining only the first entry, leaving the second, malicious file completely unchecked by the system.

Patchstack, the WordPress security firm that first analyzed the bug, described the root cause in technical detail within its public report. The firm noted that "these two loops disagree about what to do with an empty file entry," causing validators and processors to diverge. This divergence allows the malicious payload to slip past inspection entirely and land safely inside a publicly accessible upload directory on the server.

Exploitation requires that a targeted website have a published Elementor Pro form with a File Upload field, which is fairly common. Once the payload is uploaded, its filename is generated using the PHP uniqid() function, which is time-based rather than truly random. Attackers can therefore determine the exact filename through a timing-based brute-force attack or, in some cases, through an automated email response. Requesting the file directly then triggers the server's PHP interpreter, executing the attacker's code with the web server's privileges.

Wordfence, Defiant's WordPress security platform, confirmed that active exploitation began on August 19, the same day the patched version was released. The company's firewall blocked nearly 200,000 exploitation attempts against its customers, with more than 190,000 occurring between August 19 and 23 alone. Wordfence described the attack pattern in detail, explaining that attackers submit the form's File Upload field as a two-part array.

Wordfence also published a list of IP addresses responsible for launching thousands of exploitation attempts against its monitored network of sites. Administrators are encouraged to cross-reference that list against their own server logs and to add any matching addresses to firewall blocklists. Because attackers often rotate infrastructure quickly, the list should be treated as a useful starting point rather than a complete or permanent defense.

According to Wordfence, the first array element is submitted empty while the second carries a PHP payload disguised with a .php filename. That combination, the firm wrote, is "the structure that triggers the validation bypass" attackers rely on to plant their webshells. The malicious file is then stored in/wp-content/uploads/elementor/forms/ using a random filename that retains the attacker's chosen .php extension.

Mitigation Strategies

Security researchers recommend that WordPress administrators take several immediate steps to check for and remediate any potential compromise on their sites:

• Update Elementor Pro to version 4.2.2 or later without delay.
• Inspect the /wp-content/uploads/elementor/forms/ directory for unexpected PHP files.
• Treat any PHP file found in that directory as a strong indicator of compromise.
• Block known malicious IP addresses published by Wordfence in its advisory.
• Review server logs for suspicious requests targeting Elementor form endpoints.

Patchstack cautioned that installing the update alone does not remove any malicious files that were uploaded before the patch was applied. The firm recommends a thorough manual review of affected directories, since attackers may have already established persistent access to the server. Elementor confirmed that only sites using a Pro Form with an upload field and multiple file uploads enabled face a genuine risk.

Once attackers gain a foothold through this flaw, they typically install a webshell that grants them persistent, remote control over the website. From that position, an attacker can steal customer data, deface pages, plant additional malware, or use the server to launch further attacks. Some intrusions of this kind eventually escalate into ransomware deployment or long-term espionage campaigns targeting the site owner's wider organization. Because the initial compromise can be difficult to detect, victims sometimes remain unaware of the breach for weeks or months.

This is not the first time a popular WordPress plugin has become a target for mass exploitation shortly after a patch appeared. Attackers routinely monitor plugin changelogs and reverse-engineer patches to develop working exploits within days of a fix becoming publicly available. Given Elementor Pro's massive install base, security experts expect exploitation attempts against unpatched sites to continue for weeks to come. Similar file-upload flaws have previously affected other WordPress plugins, underscoring how form-handling features remain a frequent and persistent source of serious vulnerabilities.

Beyond patching this specific flaw, WordPress site owners can adopt broader security practices to reduce their overall exposure to attacks:

• Keep all plugins, themes, and WordPress core updated on a regular schedule.
• Limit the use of file upload fields to trusted, necessary forms only.
• Deploy a web application firewall to catch exploitation attempts in real time.
• Maintain regular off-site backups to enable fast recovery from any compromise.

Checking the installed plugin version is straightforward and takes only a few minutes via the standard WordPress admin dashboard. Site owners can navigate to the Plugins section, locate Elementor Pro in the list, and confirm whether the version number reads 4.2.2 or higher. If the plugin still shows an older version, administrators should apply the update immediately rather than waiting for an automatic refresh cycle. Hosting providers and agencies managing multiple WordPress sites for clients should audit each installation, since a single overlooked site can serve as an entry point.

Site owners who suspect their installation may already be compromised should consider a full malware scan and, if needed, professional incident response. Applying the 4.2.2 update remains the single most effective step available to close this vulnerability and stop further exploitation attempts. Staying current with plugin updates, monitoring server activity, and following vendor security advisories remain the best defenses against similar attacks in the future.