Loading story…
Attackers are actively exploiting CVE-2026-32475, a critical unauthenticated arbitrary-file-upload vulnerability (CVSS 9.8) in Elementor Website Builder Pro for WordPress. The flaw affects versions through 4.2.1 and lets attackers bypass file-extension and type validation in published Elementor Pro Form widgets with non-required File Upload fields, upload PHP webshells, execute arbitrary commands, and potentially fully compromise affected sites.
The vulnerability was fixed in Elementor Pro 4.2.2. Wordfence reported blocking more than 190,000 exploitation attempts shortly after public disclosure; administrators should update immediately and investigate Elementor form-upload directories for unauthorized PHP files, which are a key indicator of compromise.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
As of September 4, WordPress data indicated that approximately two-thirds of Elementor's 10 million installations were running an Elementor Pro version vulnerable to CVE-2026-32475, highlighting the continued exposure following active exploitation.
Wordfence observed attackers actively exploiting CVE-2026-32475 beginning on the public-disclosure date. Exploitation can upload PHP webshells through vulnerable Elementor Pro form-upload fields and enable remote command execution.
Elementor released Elementor Pro 4.2.2, fixing the critical unauthenticated arbitrary file-upload vulnerability CVE-2026-32475 affecting versions 4.2.1 and earlier.
The exploitation campaign targeting CVE-2026-14894 generated more than 40,000 requests in a single day, indicating a significant spike in attacks against vulnerable Super Forms installations.
During heightened exploitation activity from August 19 through August 23, Wordfence blocked more than 190,000 attempts targeting CVE-2026-32475 against its clients.
Attackers began exploiting CVE-2026-14894, a critical unauthenticated arbitrary-file-upload vulnerability in Super Forms, to upload PHP web shells and gain remote code execution on vulnerable WordPress sites. Wordfence blocked more than 250,000 exploit attempts targeting the flaw; Super Forms fixed it in version 6.3.314.
Technical reporting detailed the Super Forms admin-ajax.php exploitation method, including a Base64-encoded PHP payload disguised as image data and the Mushr00w_upl.php upload web shell. It also described Elementor Pro's array-based file-validation bypass, the resulting upload directory, prerequisite Form widget configuration, and source IP indicators for both campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourcescworld.com
Open sourcesocradar.io
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcepatchstack.com
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the **Elementor Pro** WordPress plugin, tracked as `CVE-2026-32475`, allows unauthenticated attackers to upload arbitrary files and achieve remote code execution on affected sites. The flaw impacts versions **4.2.1 and earlier** and exists in the Forms module’s **File Upload** field, where file validation and file movement are handled inconsistently across separate loops. By crafting a multipart request with two file parts for the same field, an attacker can bypass extension checks and place a PHP file in the publicly accessible `wp-content/uploads/elementor/forms/` directory. The issue can be exploited when a published Elementor page includes a Form widget with a File Upload field, a configuration described as common because the field is not required by default. Researcher **Tin Pham (TF1T)** reported the bug through the Patchstack Bug Bounty Program, and Elementor addressed it in **version 4.2.2** by aligning the loop logic and adding an extension check in the file-move path. Defenders were warned that upgrading does not remove files already uploaded through exploitation and should inspect the Elementor forms upload directory for unexpected PHP files.
Aug 26, 2026
More than 10,000 WordPress sites using the King Addons for Elementor plugin are at risk of total site compromise due to two critical vulnerabilities. The first flaw, an unauthenticated privilege escalation (CVE-2025-8489), allows attackers to register new accounts with administrator privileges by exploiting improper role restrictions in plugin versions 24.12.92 through 51.1.14. The second vulnerability, an unauthenticated arbitrary file upload (CVE-2025-6327), enables attackers to inject malicious files into various directories by abusing an AJAX handler's exposed nonce, further increasing the risk of site takeover. Security researchers from Patchstack and Wordfence have confirmed that both vulnerabilities are remotely exploitable and require no authentication, making them highly attractive targets for threat actors. Site administrators are strongly urged to update to patched versions of the plugin, which now include a role allowlist, improved input sanitization for account creation, and stricter file type validation in the upload handler. Immediate patching is recommended to prevent exploitation and potential full compromise of affected WordPress sites.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026