Attackers are actively exploiting a critical Elementor Pro vulnerability that can let unauthenticated users upload arbitrary files, including PHP payloads that may lead to remote code execution and full site takeover. Wordfence says its firewall has already blocked more than 190,000 exploit attempts since the issue was disclosed on August 19, 2026.
Elementor Pro vulnerability is being hit in the wild
The flaw affects Elementor Website Builder Pro, the WordPress plugin with more than 6,000,000 active installations. According to Wordfence Intelligence, the bug is a critical unauthenticated arbitrary file upload issue tracked as CVE-2026-32475, with a CVSS score of 9.8.
Wordfence publicly disclosed the issue on August 19, 2026, the same day the vendor released a fully patched version. At the time of writing, the patched release is version 4.2.2, and the affected versions are listed as 4.2.1 and earlier.
Why this issue is so dangerous
The vulnerability exists in the Elementor Pro Form widget’s file upload handling. In affected versions, a validation logic error can cause extension and file type checks to be skipped for certain uploads, making it possible for attackers to submit files with arbitrary extensions such as .php.
That matters because uploaded PHP files placed in a web-accessible location can be executed by the server. In practice, that can give an attacker the ability to run commands, deploy a webshell, or take over the site entirely.
How the bypass works
Wordfence says exploitation requires a published page containing an Elementor Pro Form widget with at least one non-required File Upload field. The attack uses the file field as an array: the first element is empty, which triggers a bypass condition, and the second element contains the malicious file.
In the example shared by Wordfence, the request is sent to /wp-admin/admin-ajax.php with the action elementor_pro_forms_send_form. The uploaded payload is written to /wp-content/uploads/elementor/forms/ under a randomly generated filename with the attacker-supplied PHP extension.
Once that file is in place, the attacker can request it directly and execute arbitrary commands on the server. Wordfence redacted the webshell payload from its example to avoid publishing working exploit code.
Attack traffic began immediately after disclosure
Wordfence says threat actors started targeting websites the same day the vulnerability was disclosed, on August 19, 2026. The firm also saw a large wave of exploit attempts from August 19 through August 23.
Its firewall has blocked more than 190,000 attempts in total. That volume suggests the bug quickly became part of active mass exploitation, not just a theoretical concern for site owners.
Top offending IP addresses named by Wordfence
- 2602:fa59:10:7a1::1 — over 28,000 blocked requests
- 185.196.220.85 — over 23,800 blocked requests
- 103.84.230.85 — over 23,600 blocked requests
- 103.90.148.202 — over 15,300 blocked requests
- 216.126.225.208 — over 15,000 blocked requests
- 167.254.240.75 — over 8,100 blocked requests
- 167.254.241.119 — over 7,700 blocked requests
- 114.10.17.253 — over 6,100 blocked requests
- 114.10.45.151 — over 5,700 blocked requests
- 2406:ef80:2:7d19::1 — over 4,800 blocked requests
What Wordfence users are protected
Wordfence says all users of its firewall are protected from exploit attempts targeting this vulnerability, including those on Wordfence Premium, Wordfence Care, Wordfence Response, and the free version of Wordfence. The protection relies on the firewall’s built-in Malicious File Upload detection.
There is one important configuration detail: Wordfence says the protection against PHP execution in the uploads directory only works if the Disable Code Execution for Uploads directory option is enabled in Wordfence Global Options. The company strongly recommends enabling it.
What site owners should do now
Even if a firewall blocks attack traffic, the safest step is to update Elementor Pro immediately. Wordfence urges users to move to the latest patched release, which it lists as version 4.2.2.
Site administrators should also check for signs of compromise. Wordfence recommends reviewing the /wp-content/uploads/elementor/forms/ directory for any unexpected PHP files, since that location should only contain form uploads and should not normally include executable code.
It also advises reviewing web server access logs for suspicious requests to /wp-admin/admin-ajax.php with the action parameter set to elementor_pro_forms_send_form, especially if the requests came from the IP addresses it identified.
Practical response checklist
- Update Elementor Pro to version 4.2.2 or later.
- Confirm Wordfence’s Disable Code Execution for Uploads directory setting is enabled.
- Inspect
/wp-content/uploads/elementor/forms/for any .php files. - Review access logs for suspicious form submission attempts.
- If compromise is suspected, remove unexpected files and check for backdoors.
Wordfence notes that the absence of suspicious log entries does not prove a site is safe, and it warns that compromised sites may need a broader cleanup beyond deleting the uploaded file.
Why this matters beyond Elementor Pro
This incident is a reminder that file upload flaws remain one of the fastest paths from a form submission to full site compromise. When a plugin handles uploads incorrectly, a simple website feature can become a server-level security issue.
For WordPress site owners, the lesson is straightforward: keep plugins patched, limit unnecessary upload features, and treat any unexpected executable file in an uploads directory as a serious red flag.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 3, 2026 at 1:53 am
5 views
