Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

What happened

A critical security flaw in the Elementor Pro WordPress plugin is being actively exploited in the wild, giving attackers a straightforward path to plant malicious files on vulnerable sites. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.8, placing it at the top of the severity scale and making it one of the more dangerous plugin flaws disclosed this year.

This article breaks down what the vulnerability is, how attackers are using it, which sites are at risk, and what site owners and developers need to do right now. If you build, manage, or secure WordPress sites that use Elementor Pro, this is directly relevant to your infrastructure.

Security researchers identified and disclosed CVE-2026-32475, an arbitrary file upload vulnerability residing in the Elementor Pro WordPress plugin. The issue lives specifically in the function that handles form submissions, a component used extensively across Elementor-powered sites to collect user input. With a CVSS score of 9.8 out of 10, it is classified as critical. Exploitation has moved beyond theoretical — attackers are actively abusing the flaw in the wild, meaning the window for a safe, unrushed response has already closed for any site that has not taken action.

How it works

The flaw was reported by SecurityWeek and is severe enough that it represents a full remote compromise path. An attacker does not need elevated privileges to exploit the file upload pathway. Once a malicious file lands on the server through the vulnerable form handler, the attacker typically has the ability to execute code or establish persistent access, depending on server configuration.

Any WordPress site running the Elementor Pro plugin and relying on its form submission functionality is potentially exposed. Elementor Pro is one of the most widely installed premium page-builder plugins in the WordPress ecosystem, which means the blast radius of this vulnerability is substantial. Shared hosting environments are particularly at risk because a single compromised account can sometimes be leveraged to reach neighboring sites on the same server.

Why it matters

Site administrators who have installed Elementor Pro but have not applied a patch, or who have forms enabled and accessible to unauthenticated visitors, face the highest level of immediate risk. Developers who have deployed Elementor Pro on behalf of clients are also in scope, since client sites may not receive timely maintenance updates unless there is a managed update agreement in place.

The first priority is to identify every WordPress installation under your control that has Elementor Pro installed and determine whether the form submission feature is active. Check your plugin dashboard for the installed version and cross-reference it against any patched version released by the Elementor team in response to CVE-2026-32475. Apply the update immediately on all affected installations, including staging and production environments.

Beyond patching, review your server's upload directories for unexpected files, particularly PHP files that should not be there. A web application firewall configured to block suspicious file upload requests through form endpoints can serve as an interim layer of defense for sites that cannot be patched instantly. Review server access logs for anomalous POST requests to form-handling endpoints, which may indicate exploitation attempts have already occurred.

Who is affected

Arbitrary file upload vulnerabilities exploit insufficient validation on the server side when accepting user-submitted content. In the case of CVE-2026-32475, the Elementor Pro form submission handler failed to adequately restrict what type of file a user could upload through a form field. When a legitimate-looking request is crafted to bypass the expected file type checks, an attacker can push a file — typically a web shell written in PHP — directly onto the web server.

Once that file is written to a web-accessible directory, the attacker simply navigates to its URL to execute arbitrary commands on the underlying host. The severity of the outcome depends on the server's permission model and whether PHP execution is restricted in upload directories, but default WordPress hosting setups often permit execution in common upload paths. The attack requires no authentication, which is why the CVSS score sits at 9.8.

What to watch next

The full scope of exploitation campaigns taking advantage of CVE-2026-32475 has not been publicly quantified. It is not yet clear how many sites have already been compromised, which threat actors are behind the active exploitation, or what payloads are being deployed after successful file upload. SecurityWeek's report confirms exploitation is occurring, but attribution and campaign scale remain open questions.

It is also not publicly confirmed whether all versions of Elementor Pro are affected equally, or whether certain configurations reduce exposure. Details about whether the vulnerability requires forms to be published and publicly accessible, or whether it can be triggered through authenticated sessions as well, have not been fully disclosed. Site owners should treat any Elementor Pro installation with active forms as potentially vulnerable until the vendor provides a complete disclosure or a confirmed safe version.