Security experts at Defiant have issued a warning about a critical vulnerability in the Elementor Pro WordPress plugin, which is actively being exploited by hackers to compromise websites. The vulnerability, identified as CVE-2026-32475, has a CVSS score of 9.8, indicating its severe impact.
Vulnerability Details and Impact
Elementor, a widely used drag-and-drop website builder plugin for WordPress, boasts over 10 million installations. Its premium version, Elementor Pro, offers enhanced features such as a Form widget with File Upload capabilities. The flaw arises from an arbitrary file upload vulnerability within the form submission handling process.
Normally, when a form submission with an empty upload field is detected, it should be skipped, allowing the validation process to continue. However, the vulnerability causes the validation to abort, skipping checks on files in the same form field, allowing attackers to upload malicious PHP files.
Immediate Threats and Exploitation
Attackers are exploiting this vulnerability by submitting a file upload field as an array. The first part is an empty slot that triggers the erroneous return, while the second part carries a PHP payload. This payload bypasses validation and is written to the server disk, leading to potential full site compromise.
Defiant has blocked over 190,000 exploitation attempts since the patch was released on August 19. The vulnerability affects all Elementor Pro versions up to 4.2.1, with the issue resolved in version 4.2.2. Site owners are urged to update immediately to prevent breaches.
Mitigation Measures and Recommendations
Administrators are advised to inspect the /wp-content/uploads/elementor/forms/ directory for any PHP files, as these are indicators of compromise. Checking server logs for requests to /wp-admin/admin-ajax.php is also recommended to uncover unauthorized access attempts. Additionally, site audits for potential backdoors should be conducted if a breach is suspected.
While Elementor Pro has over 6 million active users, the exact number of affected installations is unclear. As of early September, two-thirds of Elementor’s 10 million installations were still running a vulnerable version, highlighting the urgency of applying the security update.
For further insights, related security reports include vulnerabilities in PostgreSQL, VMware, and Chrome, emphasizing the pervasive nature of cybersecurity threats across various platforms.
