Attackers Race to Exploit Elementor Pro Flaw, 190,000 Attempts Logged in Four Days

Key points

• A critical flaw in Elementor Pro, tracked as CVE-2026-32475, lets attackers upload malicious files to WordPress sites.
• Elementor released a fix in version 4.2.2 on August 19, 2026.
• Security firm Wordfence blocked more than 190,000 exploitation attempts between August 19 and 23.
• Elementor Pro has over 6 million active installations, making the attack surface unusually large.
• Only sites with a published form containing a File Upload field are exploitable, which is still a common setup.

Criminals are hammering WordPress websites through a freshly patched flaw in Elementor Pro, a drag-and-drop website builder installed on more than 6 million sites.

The bug, CVE-2026-32475, lets an attacker plant a webshell on the server. A webshell is a small malicious file that gives the intruder a remote command line, letting them run whatever they like on the site. We first reported this vulnerability on 20 August in "Elementor Pro flaw let attackers plant executable files on WordPress sites"; Wordfence's block count has since climbed to 190,000.

Elementor shipped a fix in version 4.2.2 on August 19. Attackers began exploiting the flaw the same day, according to Wordfence, the WordPress security firm whose firewall blocked almost 200,000 attempts in the first four days.

What does the flaw actually do?

It lets a stranger upload a PHP file, a script the server will execute, into a public folder on your website.

The weakness sits in how Elementor Pro's contact forms check uploaded files. An attacker submits two files at once: an empty one first, a booby-trapped PHP file second. The plugin skips the check on the second file. The payload lands in /wp-content/uploads/elementor/forms/ under a randomly generated name; the attacker then fetches that URL and starts issuing commands. Patchstack warned last month that the same technique could trigger arbitrary PHP code execution on the server.

Which sites are at risk?

Any WordPress site running Elementor Pro 4.2.1 or earlier with a published form containing a File Upload field. Contact forms and job application forms both tend to use it.

Sites that never added a file upload widget aren't exploitable through this bug, but should still update. The campaign, first reported by BleepingComputer, has targeted a broad slice of the WordPress ecosystem rather than any single sector.

What should site owners do right now?

Update Elementor Pro to 4.2.2 or later today, then check the uploads folder for anything that shouldn't be there.

Log in to the WordPress admin panel and run the plugin update. Then, using your hosting file manager or FTP, open /wp-content/uploads/elementor/forms/ and look for files ending in .php. That folder is only meant to hold form submissions, so any PHP file there is a red flag. If one is present, assume the site is compromised: change all admin passwords, rotate database credentials, and examine recently modified files. Wordfence has published a list of attacker IP addresses that administrators can add to their blocklists.

What about ordinary visitors to these sites?

If you filled in a contact form on a small business site in the last week, there's no direct risk to your computer. The concern is the site itself, which could be serving malicious content to other visitors or redirecting them to scam pages. Watch for unexpected password reset emails from any site where you have an account.

Site owners who paid for Elementor Pro and never enabled auto-updates are the most exposed. Six million installations is a large pool, and criminals only need a fraction to stay unpatched. Given that WordPress plugin exploits have been arriving in waves this summer, the window between patch and mass exploitation is now measured in hours, not days.