actively-exploited-vulnerabilityinternet-facing-service-vulnerabilityrapid-weaponizationwidely-deployed-product-advisory

Actively Exploited Elementor Pro Flaw Enables WordPress Site Takeover

Active Exploitation · 12 sources · Updated 2mo ago · First seen Sep 2, 2026

Attackers are actively exploiting CVE-2026-32475, a critical unauthenticated arbitrary-file-upload vulnerability (CVSS 9.8) in Elementor Website Builder Pro for WordPress. The flaw affects versions through 4.2.1 and lets attackers bypass file-extension and type validation in published Elementor Pro Form widgets with non-required File Upload fields, upload PHP webshells, execute arbitrary commands, and potentially fully compromise affected sites.

The vulnerability was fixed in Elementor Pro 4.2.2. Wordfence reported blocking more than 190,000 exploitation attempts shortly after public disclosure; administrators should update immediately and investigate Elementor form-upload directories for unauthorized PHP files, which are a key indicator of compromise.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

7 events · Jul 14, 2026 – Sep 4, 2026

Reported Sep 4, 20262mo ago
Technical exploit details and IOCs disclosed for Super Forms and Elementor Pro
Technical reporting detailed the Super Forms admin-ajax.php exploitation method, including a Base64-encoded PHP payload disguised as image data and the Mushr00w_upl.php upload web shell. It also described Elementor Pro's array-based file-validation bypass, the resulting upload directory, prerequisite Form widget configuration, and source IP indicators for both campaigns.
Над 440.000 обиди за експлоатација ги таргетираат пропустите за RCE во Super Forms и Elementor Pro | MKD-CIRT | Национален центар за одговор на компјутерски инциденти
Sep 4, 20262mo ago
WordPress data shows most Elementor installations remain vulnerable
As of September 4, WordPress data indicated that approximately two-thirds of Elementor's 10 million installations were running an Elementor Pro version vulnerable to CVE-2026-32475, highlighting the continued exposure following active exploitation.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites - SecurityWeek
Aug 19, 20263mo ago
Attackers begin exploiting Elementor Pro upload flaw
Wordfence observed attackers actively exploiting CVE-2026-32475 beginning on the public-disclosure date. Exploitation can upload PHP webshells through vulnerable Elementor Pro form-upload fields and enable remote command execution.
Critical Elementor Pro flaw exploited to take over WordPress sites
Aug 19, 20263mo ago
Elementor releases patch for CVE-2026-32475
Elementor released Elementor Pro 4.2.2, fixing the critical unauthenticated arbitrary file-upload vulnerability CVE-2026-32475 affecting versions 4.2.1 and earlier.
Critical Elementor Pro flaw exploited to take over WordPress sites
Aug 18, 20263mo ago
Super Forms exploitation exceeds 40,000 requests in one day
The exploitation campaign targeting CVE-2026-14894 generated more than 40,000 requests in a single day, indicating a significant spike in attacks against vulnerable Super Forms installations.
WordPress Super Forms & Elementor Pro RCE Flaws Exploited: CVE-2026-14894, CVE-2026-32475 | The CyberSec Guru
Aug 2026
Wordfence blocks more than 190,000 exploitation attempts
During heightened exploitation activity from August 19 through August 23, Wordfence blocked more than 190,000 attempts targeting CVE-2026-32475 against its clients.
Critical Elementor Pro flaw exploited to take over WordPress sites
Jul 14, 20264mo ago
Attackers begin exploiting Super Forms file-upload flaw
Attackers began exploiting CVE-2026-14894, a critical unauthenticated arbitrary-file-upload vulnerability in Super Forms, to upload PHP web shells and gain remote code execution on vulnerable WordPress sites. Wordfence blocked more than 250,000 exploit attempts targeting the flaw; Super Forms fixed it in version 6.3.314.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Arbitrary File Upload to RCE in Elementor Pro Forms (CVE-2026-32475)

Affected products

1 linked

Elementor Pro

Observables

20 linked

IPv4 address•••.••.•••.•••IPv6 address••••:••••:•••:••••IPv4 address•••.••.•••.•••IPv6 address••••:••••:••:••••IPv4 address•••.••.•••.•••IPv4 address•••.•••.••.•••IPv4 address•••.••.•••.•••IPv4 address•••.•••.••.•••+12

Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

12 references tracked. Mallory keeps watching after this page renders.

Cysecurity NewsNews · Sep 5, 2026

Elementor Pro WordPress Flaw Exploited to Upload Webshells and Execute Commands - CySecurity News - Latest Information Security and Hacking IncidentsOpen source ↗

Security WeekNews · Sep 5, 2026

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites - SecurityWeekOpen source ↗

ScworldNews · Sep 4, 2026

Critical vulnerability in Elementor Pro exploited for RCE attacks | brief | SC MediaOpen source ↗

Socradar BlogNews · Sep 4, 2026

Elementor Pro RCE Flaw Under Active AttackOpen source ↗

4 additional sources from 03-09-2026 to 04-09-2026

Bleeping ComputerNews · Sep 3, 2026

Critical Elementor Pro flaw exploited to take over WordPress sitesOpen source ↗

Malware NewsNews · Sep 2, 2026

Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

PatchstackNews · Jul 16, 2026

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin - PatchstackOpen source ↗

WordfenceNews

[no-title]Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News