Elementor Pro WordPress Plugin Vulnerability Exploited in Attacks
- Severity
- CRITICAL
- Affected component
- elementor pro (wordpress)
- Patched version
- Not yet available
A critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being actively exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.
What happened
The vulnerability, tracked as CVE-2026-32475, allows unauthenticated attackers to upload files of any type, including executable PHP files, leading to remote code execution. This can be abused to create administrator accounts, exfiltrate data, or seize control of the entire WordPress site. The vulnerability was patched on August 19, but threat actors have been exploiting it since then. Wordfence has blocked almost 200,000 exploitation attempts targeting its clients.
The issue stems from faulty validation of file-upload arrays in Elementor Pro forms and is present in versions 4.2.1 and earlier. By submitting an empty file as the first array element and a malicious PHP file as the second, attackers can cause the plugin to stop validating subsequent files. The uploaded payload can then be used to execute arbitrary commands on the server.
What to do about it
- Upgrade to the latest version of Elementor Pro.
- Review server logs for signs of compromise.
- Monitor the primary sources for updates on the vulnerability and any new patches.
How 0Day would have caught this
elementor pro is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Elementor Pro for WordPress, you may be affected. The vulnerability is present in versions 4.2.1 and earlier.
What should I do right now?
Upgrade to the latest version of Elementor Pro and review your server logs for signs of compromise.
Has this been exploited in the wild?
Yes, the vulnerability is being actively exploited in attacks.