Elementor Pro Flaw Exploited to Backdoor WordPress Sites

Attackers are actively exploiting CVE-2026-32475, a CVSS 9.0 file upload flaw in the Elementor Pro WordPress plugin, to plant webshells on unpatched sites. If you run Elementor Pro 4.2.1 or earlier, update to 4.2.2 now. Active exploitation means adversaries are scanning for unpatched installs right now, not eventually.

What the flaw is

The vulnerability is an unrestricted file upload issue. NVD’s entry describes it as an “Unrestricted Upload of File with Dangerous Type” flaw that allows attackers to use malicious files against affected installations. CVSS scores it at 9.0 critical.

BleepingComputer reported on September 3 that exploitation is live: attackers are delivering webshell payloads through this vector, which gives them the ability to execute arbitrary commands on the underlying server. The vulnerability was disclosed and patched in August; the window between patch and active exploitation was short.

Versions through 4.2.1 are affected. Version 4.2.2 closes the hole.

What to do

Update Elementor Pro to version 4.2.2 or later through your WordPress plugin dashboard. If you’re on a managed host, confirm the update actually landed: paid plugin auto-updates require an active license key, and they can silently stall if the key has expired or lost connection to the license server.

If you can’t update immediately, deactivate Elementor Pro until you can. A broken page builder is a better outcome than a compromised server.

Once you’ve patched, audit your upload directories for unexpected PHP files. Webshell names and paths vary widely, so there’s no single filename to grep for. Look for PHP files in directories that should only hold images or media uploads, and check recently modified files in the WordPress uploads folder.

If you run a WAF in front of your WordPress install, check whether your provider has pushed a virtual patch for CVE-2026-32475. That reduces exposure but does not replace updating the plugin.

The pattern here

Unrestricted file upload flaws in WordPress plugins keep showing up as exploited-in-wild entries. A similar flaw in Profile Builder allowed unauthenticated file uploads in August. The Avada theme patched a zero-click RCE the same month, and miniOrange SAML flaws hit active exploitation shortly after their August disclosure.

The common thread is that critical WordPress plugin flaws are routinely weaponized within days or weeks of disclosure. The remediation here is the same as it always is: patch promptly, and check your update mechanism actually works for premium plugins before you need it.