Elementor Pro flaw CVE-2026-32475 exploited to upload PHP web shells on WordPress sites

Attackers are actively exploiting a critical vulnerability in Elementor Pro to upload PHP web shells onto WordPress sites, according to a BleepingComputer report summarized on dev.to. The firewall vendor Wordfence has blocked more than 190,000 attack attempts against the flaw, tracked as CVE-2026-32475. Elementor Pro versions up to and including 4.2.1 are vulnerable, and the fix ships in version 4.2.2.

One caveat from the reporting: the 190,000 figure counts blocked attempts, not successful compromises, and converting an upload into remote code execution depends on an additional server condition. The volume nevertheless signals a mass campaign against one of the most widely deployed commercial WordPress plugins.

How the attack works

The vulnerability sits in how Elementor Pro validates files submitted through its form builder. Exploitation requires a publicly reachable page containing an Elementor Pro form with at least one File Upload field that has not been marked as mandatory.

An unauthenticated attacker sends a crafted multipart POST request to /wp-admin/admin-ajax.php invoking the elementor_pro_send_form action. The trick is to submit the File Upload field as an array whose first element is empty. That empty element produces an UPLOAD_ERR_NO_FILE error, and the plugin's Upload::validation() routine responds by returning early, skipping the extension and file type checks that should apply to the remaining elements of the array.

The result is that a PHP file placed alongside the empty element is accepted and written to /wp-content/uploads/elementor/forms/ under a randomized filename with a .php extension. If the hosting configuration permits PHP execution inside the uploads directory, the attacker can request the file directly to execute arbitrary commands on the server. Reports of malicious uploads alone do not confirm that code execution occurred; that final step requires the upload directory to allow script execution.

Impact and detection

The attack needs no authentication and no user interaction, so site owners may only notice a compromise after the fact, for example through defacement or suspicious redirects. If a web shell is deployed and used, the possible fallout includes credential and database theft and malware distribution to visitors, although the reporting does not confirm these outcomes at scale.

For administrators triaging exposure, the reporting points to several observable signs:

• Web server, reverse proxy or WAF logs showing multipart POSTs to /wp-admin/admin-ajax.php.
• Files with random names and .php extensions under wp-content/uploads/elementor/forms/.
• GET requests in access logs to files in that directory, suggesting an attacker tried to reach an uploaded shell.
• If endpoint telemetry exists, shells or download tools spawned by the PHP or web server worker process.

The mere presence of an uploaded file does not prove it was executed, so investigators are advised to keep attack attempts, successful uploads, PHP execution, command execution and follow-on theft as separate judgement stages.

Patching and hardening

The primary fix is to update Elementor Pro to version 4.2.2 or later. Sites that cannot update immediately can reduce risk in other ways:

• Disable PHP and other script execution in the uploads directory. This blocks the code execution step even if a malicious file lands, and is a distinct control from preventing uploads themselves.
• Use WAF or server rules to reject executable file uploads, without blanket-blocking array-formatted submissions, since legitimate form traffic can also use that format.
• Audit uploads/elementor/forms/ for unexpected .php files and review surrounding log entries.

For sites already compromised, the recommended response is to isolate the site, preserve evidence, remove suspicious files, update the plugin, and rotate credentials and database secrets that may have been exposed.

Why it matters

The flaw turns an ordinary feature, an optional file attachment field on a public form, into a path to remote code execution with no credentials and no victim interaction required. The early-return pattern in the validation code is also a textbook case of how a single error-handling shortcut can unravel an entire security check when input arrives in an unexpected shape.

Because the vulnerable configuration is common and exploitation is already at scale, operators running Elementor Pro should treat this as an urgent patch rather than routine maintenance. Wordfence's numbers measure attackers' reach, not their success, but for any site that lags on updating, the difference between a blocked attempt and a full compromise may come down to whether PHP execution was disabled in the uploads folder.