SECURITYWEEK reports that a critical vulnerability in the Elementor Pro WordPress plugin has been exploited to hack websites. Tracked as CVE-2026-32475 with a CVSS score of 9.8, the flaw is an arbitrary file upload issue in the form submission handling. The bug occurs when the validation loop hits an upload slot marked as empty, causing the validation to abort and allowing a second, unvalidated file in the same form field to be written to disk.
An unauthenticated attacker can submit an array with an empty slot followed by a PHP payload, which is then uploaded without validation and can be executed on the server.
Defiant notes that CVE-2026-32475 affects all Elementor Pro versions up to 4.2.1 and was patched in version 4.2.2 released on 19 August 2026. Security researchers say exploitation began soon after the fix landed, with more than 190,000 exploit attempts blocked to date. The vulnerability can result in a PHP file being written to /wp-content/uploads/elementor/forms/, a strong indicator of compromise.
Site administrators are advised to check that directory for PHP payloads, review logs for requests to /wp-admin/admin-ajax[.]php, and examine sites for backdoors where compromise is suspected. SecurityWeek notes that Elementor Pro has over 6 million active installations, and WordPress data cited by the article indicates roughly two-thirds of Elementor’s 10 million installations run a vulnerable version as of 4 September.