GoKawiilAttackers exploit patched Elementor Pro flaw to plant webshells on WordPress sites
Hackers are actively exploiting CVE-2026-32475, a critical vulnerability in Elementor Pro affecting version 4.2.1 and earlier, by abusing a file-upload validation flaw in the plugin's form widget to upload malicious PHP files and run commands on compromised servers. Elementor patched the bug on August 19 with version 4.2.2, but Wordfence says exploitation began the same day and has already blocked nearly 200,000 attack attempts.
GoKawiil's interpretation of the reporting above, not reported fact.
Elementor Pro runs on more than 6 million WordPress sites, so any site using its File Upload form field remains at risk until updated, giving attackers a wide pool of potential targets. The speed at which exploitation began right after disclosure shows how quickly threat actors weaponize newly patched vulnerabilities, underscoring the urgency of applying updates immediately rather than delaying.
- CVE-2026-32475 lets attackers bypass file-upload validation in Elementor Pro's form widget to plant PHP webshells.
- Nearly 200,000 exploitation attempts have been blocked by Wordfence since the flaw was patched on August 19.
- Sites remain vulnerable if running Elementor Pro 4.2.1 or earlier with a published File Upload form field; updating to 4.2.2 is essential.
Yubico YubiKey 5 NFC Security Key — When WordPress plugin flaws like this Elementor Pro bug are being actively exploited, hardening admin logins is the next best move. The YubiKey 5 NFC adds hardware-backed two-factor authentication to WordPress, Google, and countless other accounts with a tap or touch, so a stolen password alone won't get anyone into your dashboard.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-03
Published there as: “Critical Elementor Pro flaw exploited to take over WordPress sites”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.