Elementor Pro is getting popped. The bug is simple. The scale is not. Elementor is the drag-and-drop builder…
Zane A. — Security Consultant
Elementor Pro is getting popped. The bug is simple. The scale is not.
Elementor is the drag-and-drop builder sitting on more than 10 million WordPress sites. Elementor Pro is the paid layer; forms, file uploads, the stuff marketing teams actually use. That paid layer is what attackers are hitting.
CVE-2026-32475. Score: 9.8. No login required.
The Form widget is supposed to check every file that comes in. It does not.
If the first slot in an upload field is empty, the validator hits an error and returns. It should skip that empty slot and keep checking. It does not. Everything after that empty slot skips type checks.
So the attacker sends two parts in one field:
1. An empty file; validation dies
2. A .php webshell; never inspected, written to disk
The processing function then does the opposite of the validator: it skips the empty part and saves the second file anyway. Request that file. You are executing PHP as the web server. From there it is a normal WordPress takeover; admin account, plugin backdoor, data, whatever they came for.
Patched in Elementor Pro 4.2.2 on 19 August 2026. Everything through 4.2.1 is in the blast radius.
They started scanning the same day the fix shipped. Defiant / Wordfence has already blocked 190,000+ exploit attempts. That is not “theoretical CVSS.” That is mass exploitation.
If you own or inherit WordPress estates
• Get Pro to 4.2.2 or later. Today.
• Look in /wp-content/uploads/elementor/forms/. A .php file there is compromise, not a form attachment.
• Grep logs for /wp-admin/admin-ajax.php around form uploads.
• If you find a shell, assume persistence; new admins, extra plugins, modified themes. Clean the site, do not just delete the one file.
Not every Pro install is exploitable. You need a published page with an Elementor Form and a File Upload field. That configuration is everywhere. Treat “we use Elementor for the contact form” as in-scope.
Pro has 6 million+ active installs. How many still have the upload field and an old build is the only number that matters, and most teams cannot answer it.
The actual lesson
This is not a “WordPress is insecure” story. It is a plugin-inventory story.
The vulnerability is a return where the code needed a continue. One control-flow mistake in a paid form widget, and unauthenticated RCE is on the public internet. “Pro” did not mean reviewed. Patch Tuesday for marketing sites is still optional in too many companies; which is why the scanners showed up before the change tickets did.
If you run web, appsec, or a messy WP fleet: plugin inventory is a security control. Own the list. Own the versions. Own the upload directories.
ISCSECURITY Master Class Series: https://iscsecurity.org
Join the discussion: https://cyberr.ai/groups/iscsecurity
Instagram: https://www.instagram.com/iscsecurity73/
GitHub: https://github.com/zanderson73/
2 reactions · 2 comments
Comments
Innocent A.: This is a critical risk for people who use this plugin, I still use WordPress but I've decided to build custom themes rather than using vulnerable plugins especially when I'm working on clients project. What do you think about using WordPress today, is it still safe ?
Zane A.: If you're asking me, I would say, custom themes help. They do not make the problem go away though. WordPress core is not what keeps landing in mass-exploitation write-ups. Plugins and leftover “Pro” features are. Elementor Pro is 6mil+ installs, one bad return in an upload validator, unauth RCE. That is a supply-chain and inventory problem, not a “CMS is illegal” problem. Is WordPress still safe?