Hackers have been exploiting a critical-severity vulnerability within the Elementor Professional WordPress plugin to hack web sites, WordPress safety agency Defiant warns.
A extremely standard drag-and-drop web site builder, Elementor is a free WordPress plugin with over 10 million installations. Elementor Professional is the paid model that provides further options, together with a Kind widget with assist for File Add fields.
The bug, tracked as CVE-2026-32475 (CVSS rating of 9.8), is described as an arbitrary file add challenge within the perform that handles type submissions.
Whereas submissions are handed by the plugin’s validation and processing mechanisms, when the validation loop encounters an add slot marked as empty, it triggers an error and returns, aborting the validation of different recordsdata within the discipline.
The conventional conduct can be to proceed, skipping the empty entry, however the vulnerability ends in checks by no means being utilized to the remaining recordsdata uploaded by the identical type discipline.
An attacker can submit an add discipline as an array with two components: an empty slot that triggers the return, adopted by a PHP payload that’s uploaded with out validation.
As a result of the perform that handles discipline processing accurately skips the empty slot and processes the second, unvalidated a part of the sector, the attacker-supplied file is written to disk.
“Consequently, an unauthenticated attacker can request the uploaded file to execute their PHP payload on the server,” Defiant explains, noting that this might result in full website compromise.
CVE-2026-32475 impacts all Elementor Professional plugin variations as much as 4.2.1 and was patched in model 4.2.2 on August 19. Web site house owners ought to replace to the mounted iteration as quickly as attainable.
In response to Defiant, menace actors began exploiting the safety defect instantly after the fixes landed. The safety agency has blocked over 190,000 exploit makes an attempt so far.
Profitable exploitation of the vulnerability ends in a PHP file being written to the /wp-content/uploads/elementor/types/ listing, which shops uploaded type submissions.
Web site directors are suggested to examine the listing for the presence of any PHP file, which is a robust indicator of compromise (IoC). They need to additionally examine logs for requests to /wp-admin/admin-ajax.php and examine their websites for backdoors if any proof of compromise is found.
Defiant notes that Elementor Professional has over 6 million lively installations, however it’s unclear what number of of them are affected. In response to WordPress knowledge, roughly two-thirds of Elementor’s 10 million installations run a weak plugin model as of September 4.
Associated: 12-Yr-Outdated PostgreSQL Vulnerability Allows Database, Server Takeover
Associated: VMware Workstation and Fusion Updates Patch Essential Vulnerability
Associated: Google Patches sixth Chrome Zero-Day of 2026
Associated: Over 3 Million WordPress Websites Affected by Migration Plugin Vulnerability
