A critical security vulnerability in Elementor Pro, the popular WordPress page builder plugin with over 6 million active installations, is currently being actively exploited by attackers. The Wordfence firewall has already blocked over 190,000 exploit attempts targeting this vulnerability, making it one of the most significant WordPress security threats in recent months.
If your website uses Elementor Pro, this is a must-read.
The vulnerability, tracked as CVE-2026-32475, is an Unauthenticated Arbitrary File Upload flaw that allows attackers to upload malicious PHP files to your server without needing any credentials. It carries a critical CVSS score of 9.0, reflecting its severity.
How the attack works:
The vulnerability exists in the Elementor Pro Form widget’s handling of File Upload fields. When a File Upload field is not marked as required, a flaw in the field’s validation routine causes the extension and file type checks to be skipped entirely.
Attackers exploit this by submitting the file upload field as an array. The first element contains an empty filename, which triggers a validation bypass. The second element then carries the malicious .php file, which is written directly to the server.
The result: An attacker can upload a PHP webshell to your site, execute arbitrary commands, and achieve complete site takeover; all without needing a username or password.
What makes this vulnerability particularly dangerous is that it requires no authentication. Any visitor to your site can exploit it.
According to Wordfence’s threat intelligence, attackers began targeting this vulnerability the same day it was publicly disclosed on August 19, 2026. The heaviest activity occurred between August 19th and 23rd.
Top offending IP addresses responsible for the most exploit attempts include:
| IP Address | Blocked Requests |
|---|---|
2602:fa59:10:7a1::1 | Over 28,000 |
185.196.220.85 | Over 23,800 |
103.84.230.85 | Over 23,600 |
103.90.148.202 | Over 15,300 |
216.126.225.208 | Over 15,000 |
167.254.240.75 | Over 8,100 |
167.254.241.119 | Over 7,700 |
114.10.17.253 | Over 6,100 |
These numbers illustrate the scale and urgency of the threat.
Your site is vulnerable if:
The good news: Elementor released a fully patched version (4.2.2) on August 19, 2026, the same day the vulnerability was disclosed.
The single most critical action is to update your Elementor Pro plugin to version 4.2.2 or later
To update:
A successful attack results in a PHP file being written to the following directory:
/wp-content/uploads/elementor/forms/This directory should never contain PHP files. We strongly recommend reviewing this directory and removing any unexpected .php files.
Also review your server access logs for requests to:
/wp-admin/admin-ajax.php?action=elementor_pro_forms_send_formPay special attention to requests originating from the IP addresses listed above.
If you use Wordfence, ensure the “Disable Code Execution for Uploads directory” option is enabled in the Wordfence Global Options page. This provides an additional layer of protection against file upload attacks.
All Wordfence users are already protected against this vulnerability by the firewall’s built-in Malicious File Upload protection, including those running the free version.
For a complete technical analysis of the vulnerability, read Wordfence’s detailed breakdown:
At BG Cyber Connect, we understand that keeping your WordPress site secure requires constant vigilance. Our team can:
If you are unsure whether your site has been compromised or need assistance securing your WordPress installation, contact us immediately.
Update Elementor Pro to version 4.2.2 now. Over 190,000 exploit attempts have already been blocked, and attackers are actively scanning for vulnerable sites. Every day you delay increases the risk of a complete site takeover.
Need Help Securing Your WordPress Site?
Contact BG Cyber Connect for an Immediate Security Assessment
Explore our comprehensive WordPress security services:
BGCC Cybersecurity Solutions
Microsoft is retiring SMS and voice authentication for Entra ID by February 1, 2027, making passkeys the default sign-in method. For Caribbean businesses, this transition demands immediate action. Learn what is changing, when, and the steps you must take to ensure your organisation remains secure and operational. No opt-out. Act before September 2026.
On July 17, 2026, the WordPress Security Team released urgent security updates addressing a critical vulnerability chain in WordPress core affecting versions 6.8 through 7.0.1. Two flaws, CVE-2026-60137 (SQL Injection) and CVE-2026-63030 (Remote Code Execution), can be chained to allow unauthenticated attackers to take complete control of vulnerable sites. No plugins required. No authentication needed. Update to 6.8.6, 6.9.5, or 7.0.2 immediately.
DuckDuckGo now blocks most YouTube video ads by default. For businesses relying on YouTube advertising, this shift demands attention. This article explores the growing ad-blocking trend, what it means for your reach, and how to adapt with content marketing, SEO, influencer partnerships, and a diversified strategy. Future-proof your digital marketing.
Book Now!