Overview
- Elementor released a fix on August 19 for CVE-2026-32475 after researchers showed a validation flaw let attackers bypass checks and upload PHP webshells.
- Security firm Wordfence recorded a concentrated spike of exploitation attempts starting the same day, blocking roughly 190,000 Elementor probes and more than 440,000 combined attempts when paired with attacks against Super Forms.
- The bug occurs when the validator returns on an empty upload slot instead of continuing, so a later file in the same array can be written unchecked to /wp-content/uploads/elementor/forms/ with an attacker-supplied .php extension.
- Site owners should update Elementor Pro to version 4.2.2 or later, scan the elementor/forms uploads directory for unexpected .php files, review access logs for admin-ajax.php form submissions, and block PHP execution in upload folders at the webserver level.
- The attacks highlight a recurring risk from widely used WordPress plugins that accept file uploads and show that patches must be followed by audits and server hardening to prevent full site takeover, data theft, or persistent backdoors.