Attackers Race to Exploit Elementor Pro Flaw, 190,000 Attempts Logged in Four Days

Key points

• A critical flaw in Elementor Pro, tracked as CVE-2026-32475, lets attackers upload malicious files to WordPress sites.
• Elementor released a fix in version 4.2.2 on August 19, 2026.
• Security firm Wordfence blocked more than 190,000 exploitation attempts between August 19 and 23.
• Elementor Pro has over 6 million active installations, making the attack surface unusually large.
• Only sites with a published form containing a File Upload field are exploitable, which is still a common setup.

Criminals are hammering WordPress websites through a freshly patched flaw in Elementor Pro, a drag-and-drop website builder installed on more than 6 million sites.

The bug, CVE-2026-32475, lets an attacker plant a webshell on the server. A webshell is a small malicious file that gives the intruder a remote command line, so they can run whatever they like on the site.

Elementor shipped a fix in version 4.2.2 on August 19. Attackers began exploiting the flaw the same day, according to Wordfence, the WordPress security firm whose firewall blocked almost 200,000 attempts in the first four days.

What does the flaw actually do?

It lets a stranger upload a PHP file, which is a script the server will run, into a public folder on your website. From there they can execute commands.

The weakness sits in how Elementor Pro's contact forms check uploaded files. If an attacker submits two files at once, an empty one first and a booby-trapped PHP file second, the plugin skips the check on the second file. The malicious file lands in /wp-content/uploads/elementor/forms/ under a random name. The attacker then loads that file in a browser and starts running commands on the site.

WordPress security company Patchstack flagged the same technique last month, warning it could be used to run arbitrary code on the server.

Which sites are at risk?

Any WordPress site running Elementor Pro 4.2.1 or earlier and publishing an Elementor form with a File Upload field. That combination is common: contact forms, job application forms and quote request forms all tend to use it.

Sites that never added a file upload widget are not exploitable through this particular bug, but should still update. First reported by BleepingComputer, the campaign has already targeted a broad slice of the WordPress ecosystem rather than any single sector.

What should site owners do right now?

Update Elementor Pro to 4.2.2 or later today, then check the uploads folder for anything that should not be there.

Log in to the WordPress admin panel and run the plugin update. Then, using your hosting file manager or FTP, open /wp-content/uploads/elementor/forms/ and look for files ending in .php. That folder is only meant to hold form submissions, so any PHP file there is a red flag. If one is present, assume the site has been broken into and start a full clean-up: change all admin passwords, rotate database credentials, and review recently modified files.

Wordfence has published a list of attacker IP addresses that site administrators can add to their blocklists.

What about ordinary visitors to these sites?

If you filled in a contact form on a small business site in the last week, there is no direct risk to your computer. The concern is the site itself, which could be serving other visitors malicious content, harvesting form submissions, or redirecting to scam pages. Be alert for unexpected password reset emails from any site where you have an account, and treat unusual replies to forms you filled in with suspicion.

Site owners who paid for Elementor Pro and never enabled auto-updates are the ones most exposed here. Six million installations is a large pool, and criminals only need a fraction of them to stay unpatched.