Attackers are actively exploiting a critical vulnerability in Elementor Pro, the popular WordPress website builder, to upload and run malicious PHP files. The flaw can allow unauthenticated attackers to take complete control of affected sites. Administrators should update immediately and check their websites for signs of compromise.
Key takeaways
- The vulnerability is rated critical, with a CVSS score of 9.8.
- Elementor Pro versions up to 4.2.1 are affected.
- Version 4.2.2, released on 19 August, contains the fix.
- More than 190,000 exploitation attempts have reportedly been blocked.
- PHP files in the Elementor forms upload directory may indicate a breach.
This incident highlights why regular WordPress maintenance is essential, particularly for sites that rely on third-party plugins and handle visitor-submitted files.
How the Elementor Pro vulnerability works
The security issue, tracked as CVE-2026-32475, affects the form submission functionality in Elementor Pro. A validation error caused by an empty upload entry can stop the plugin from checking other files submitted through the same form field.
An attacker can exploit this behaviour by placing an empty entry before a PHP file in an upload request. The second file may then bypass security checks and be saved on the server. Once accessed, it can execute as code and potentially give the attacker full control of the website.
Why the risk is widespread
Elementor is one of the most widely used WordPress design tools, with more than 10 million installations across its free and Pro versions. Elementor Pro alone has more than 6 million active installations, according to the security report.
The scale of the threat is increased by the fact that the attack does not require a logged-in account. WordPress sites running forms with file-upload features may be particularly exposed, although administrators should treat every unpatched installation as a risk.
What website owners should do
Update Elementor Pro to version 4.2.2 or a later release as soon as possible. If automatic updates are not enabled, log in to the WordPress dashboard and update the plugin manually through the Plugins screen.
Administrators should also:
- Check
/wp-content/uploads/elementor/forms/for unexpected PHP files. - Review server and WordPress logs for suspicious requests to
/wp-admin/admin-ajax.php. - Look for unfamiliar administrator accounts, modified files and other backdoors.
- Take a fresh backup before making major cleanup changes.
- Ask a security professional to investigate if suspicious activity is found.
Deleting one malicious file may not remove an attacker’s access, so suspected compromises need a thorough review.
How a WordPress care plan can help
A WordPress maintenance plan can reduce the time between a security fix being released and it being installed. Routine plugin updates, malware monitoring, backups and vulnerability checks provide an extra layer of protection for businesses that cannot constantly monitor their websites.
Maintenance does not replace good security practices, but it can help ensure that important updates such as Elementor Pro 4.2.2 are not overlooked. For organisations that depend on their website for enquiries or sales, a proactive WordPress care plan can also make recovery faster if an attack succeeds.
The wider lesson for WordPress security
Popular plugins are attractive targets because a single weakness can expose thousands of sites. Website owners should keep WordPress, themes and plugins up to date, use reputable security tools and regularly test that backups can be restored.
The Elementor Pro campaign is a reminder that updating after a vulnerability is disclosed may not be enough if attackers move quickly. Continuous monitoring and a dependable maintenance routine are now central to running a secure WordPress website.