> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites - URL: https://f4n6.co.uk/security-feed/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/ - Published: 2026-09-05T15:50:53.000Z - Updated: 2026-09-05T15:50:53.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-32475 ## 1\. Executive summary A critical arbitrary file upload vulnerability, CVE-2026-32475 (CVSS 9.0 CRITICAL per NVD; the vendor press coverage quotes 9.8 — we treat the NVD score as authoritative), in the Elementor Pro WordPress plugin is being actively exploited in the wild, allowing unauthenticated attackers to upload and execute arbitrary PHP payloads and achieve full site compromise. The flaw affects all Elementor Pro versions up to and including 4.2.1 and was patched in version 4.2.2 on 19 August; exploitation began immediately after the fix landed, with Defiant reporting over 190,000 blocked exploit attempts. Roughly two-thirds of Elementor's \~10 million installations were running a vulnerable version as of 4 September. The vulnerability is **not** currently listed in CISA KEV, and EPSS sits at 2% — but observed mass exploitation makes this an immediate patch-and-hunt priority for any EMEA financial services client running Elementor Pro on internet-facing WordPress properties (marketing sites, landing pages, microsites), which are frequent footholds for phishing infrastructure and reputational damage. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24: digital operational resilience testing — general requirements | Exploitation is confirmed in the wild against a specific, identifiable component (Elementor Pro ≤ 4.2.1) on internet-facing web assets, with a concrete compromise indicator (PHP files in /wp-content/uploads/elementor/forms/) | Clients should fold this CVE into their resilience-testing programme as a known-exploited exposure: verify patch state and run the directory/log hunt as a targeted test, and evidence the result. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Active mass exploitation of a critical vulnerability in a widely deployed third-party component constitutes a cyber threat requiring classification under the client's ICT incident process | Clients running vulnerable versions should classify this exposure (and any confirmed compromise) through their DORA classification criteria; a confirmed web-shell on a client site may escalate to a major incident under Art. 19 reporting. | No NIS2 or UK NIS article is directly engaged beyond generic incident-reporting duties; the item's distinctive facts (known-exploited component, verifiable compromise indicator) map to the DORA rows above. ## 3\. Technical analysis & attack chain **Vulnerability mechanism (CVE-2026-32475, CWE-434 — Unrestricted Upload of File with Dangerous Type).** The flaw sits in the Elementor Pro Form widget's file-upload handling, specifically in the function that processes form submissions. Elementor Pro's Form widget supports File Upload fields. During submission processing, uploaded files are passed through the plugin's validation and processing mechanisms. The bug: when the validation loop encounters an upload slot marked as *empty*, it triggers an error and returns — aborting validation of the remaining files in the same field. Correct behaviour would be to skip the empty entry and continue validating subsequent files. Instead, the remaining files in that field are never checked. ### Confirmed attack chain 1. **Reconnaissance/targeting.** Attacker locates a WordPress site running Elementor Pro ≤ 4.2.1 with a Form widget exposing a File Upload field. 2. **Initial access.** The unauthenticated attacker submits the form's upload field as an *array* containing two parts: an empty slot (which triggers the validation error and early return) followed by a PHP payload. 3. **Validation bypass.** The early return means the second array element — the PHP payload — is never passed through file-type validation. 4. **Payload write.** The field-processing function correctly skips the empty slot and processes the second element, writing the unvalidated attacker-supplied file to disk. 5. **Execution.** The attacker requests the uploaded file directly; the PHP payload executes on the server. Defiant assesses this leads to full site compromise. **Observed impact and post-exploitation surface.** Successful exploitation results in a PHP file written to `/wp-content/uploads/elementor/forms/` — the directory where Elementor stores uploaded form submissions. Because that directory is web-accessible, the payload is directly requestable. Defiant reports exploitation began immediately after the 4.2.2 patch shipped on 19 August and has blocked over 190,000 exploit attempts to date. Defiant also advises administrators to check for backdoors on any site showing evidence of compromise, implying observed post-exploitation includes persistence beyond the initial web shell — though no specific backdoor families, C2 infrastructure, or follow-on malware are named in the source material. **Attribution.** No threat actor is named in the source material. No attribution claim is made, and none should be inferred. **Confidence caveat.** The technical mechanism, affected versions, patch timeline, exploit-attempt volume, and the directory IoC all derive from a single vendor (Defiant) as relayed by SecurityWeek — single-sourced; verify before enforcement. The CVSS discrepancy (source quotes 9.8; NVD records 9.0 CRITICAL) is noted above; both describe the same flaw. The "two-thirds of installations vulnerable" figure is attributed to WordPress's own plugin data as of 4 September. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Inventory and patch.** Identify all WordPress instances (including marketing/agency-managed and third-party-hosted sites) running Elementor Pro ≤ 4.2.1\. Update to **Elementor Pro 4.2.2 or later** immediately. Version pinning is not an option here — the fix is a version upgrade. - **Hunt for compromise.** On every site that ran a vulnerable version, inspect `/wp-content/uploads/elementor/forms/` for any `.php` file. **Any PHP file in this directory is a strong indicator of compromise.** Example: `find /path/to/wp-content/uploads/elementor/forms/ -name "*.php"`. A clean install should contain no PHP files here. - **Log review.** Check web access logs for requests to `/wp-admin/admin-ajax.php` (the AJAX endpoint through which Elementor form submissions are processed) around and since 19 August, correlating POST requests with subsequent file creation under `/wp-content/uploads/elementor/forms/`. ### P2 — within 72 hours - **On any site with a PHP file in the forms upload directory:** treat as compromised. Remove the PHP file, then conduct a full backdoor sweep per Defiant's guidance — inspect for additional web shells, modified core/plugin files, rogue administrator accounts, and scheduled jobs. Assume the attacker had code execution; rebuild from known-good if in doubt. - **Harden the upload path.** Block execution of PHP in `/wp-content/uploads/` at the web-server layer (e.g. Nginx `location ~* /uploads/.*\.php$ { deny all; }` or the Apache equivalent), so that even a future upload bug cannot yield execution. - **Disable File Upload fields** on Elementor forms that do not strictly require them, reducing exposure to this component class. ### P3 — within 7 days - **Third-party assurance.** Where WordPress properties are run by agencies or hosting providers, obtain written confirmation of Elementor Pro version and patch status — this is the supply-chain touchpoint for the DORA Art. 24/18 actions above. - **Add monitoring.** Alert on any file-creation event with a `.php` extension under `/wp-content/uploads/` (see §6). ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, URLs) are present in the source material. The source provides one directory-level behavioural indicator and two log-hunting behaviours. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------- | ------------------------------------------------------------------------------------ | | Presence of any PHP file in /wp-content/uploads/elementor/forms/ | Web server filesystem / file-integrity monitoring | High — explicitly named by Defiant as a strong IoC | | POST requests to /wp-admin/admin-ajax.php correlated with file creation under /wp-content/uploads/elementor/forms/ | Web server access logs | Medium — recommended hunt by Defiant; not unique to this exploit | | Backdoors present following confirmed upload | Full site inspection | Medium — Defiant guidance on compromised sites; no specific backdoor artefacts named | ## 6\. Detection The sources provide no file hashes, distinctive payload strings, or C2 indicators. However, the file path artefact supports a Sigma rule for web-server file-creation monitoring: ```yaml title: PHP File Created in Elementor Forms Upload Directory id: 7c3f1a2e-9b4d-4e5f-8a6b-1c2d3e4f5a6b status: experimental description: Detects creation of a PHP file in the Elementor Pro forms upload directory, a strong indicator of CVE-2026-32475 exploitation (arbitrary file upload to /wp-content/uploads/elementor/forms/). references: - https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/ author: Adverse Trace date: 2026-09-05 logsource: product: linux service: file-create detection: selection: TargetFilename|contains: '/wp-content/uploads/elementor/forms/' TargetFilename|endswith: '.php' condition: selection falsepositives: - Legitimate plugins writing PHP to the uploads directory (rare; treat any hit as suspicious) level: critical tags: - attack.persistence - attack.t1505.003 ``` A YARA rule cannot be authored: no strings, hashes, or payload artefacts from the threat itself appear in the sources. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-32475](https://nvd.nist.gov/vuln/detail/CVE-2026-32475?ref=f4n6.co.uk) | 9.0 Critical | — | 2% | Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This is… | ## 7\. Sources - SecurityWeek, "Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites," https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/, 2026-09-05 - NVD, CVE-2026-32475 (verified reference data: CVSS 9.0 CRITICAL, CWE-434, EPSS 2%, not in CISA KEV) ## 8\. Adverse Trace position This is a straightforward, high-impact exposure: an unauthenticated arbitrary file upload leading to remote code execution on a component with millions of installations, under active mass exploitation since 19 August. We assess the severity as CRITICAL per NVD (CVSS 9.0) notwithstanding the vendor-quoted 9.8, and we treat the vulnerability as actively exploited on the basis of Defiant's blocked-attempt count — single-sourced; verify before enforcement — while noting it is not yet CISA-KEV-listed and EPSS is low (2%), which we attribute to the metric lagging observed in-the-wild activity. For EMEA financial services clients, the direct risk is not to core banking systems but to the WordPress perimeter — marketing sites, campaign landing pages, and agency-managed microsites — where a web shell enables phishing-page hosting, SEO spam, and supply-chain pivot toward customers and partners; a confirmed compromise on a client-branded property is a reportable-incident question under the client's DORA classification criteria. Our next steps: monitor for CISA KEV listing and NVD/EPSS movement, seek corroboration of the Defiant findings from additional WordPress-security vendors, and update this advisory if backdoor families, actor attribution, or atomic IoCs emerge. --- [Read the original source →](https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*