Attackers went after WordPress sites running Elementor Pro on the very day the flaw in it was made public, and they have not let up since. Wordfence says its firewall has blocked more than 190,000 attempts to exploit the page builder's file upload bug, with the heaviest wave running from August 19 to August 23. What the captured requests try to do is simple and old fashioned: drop a PHP webshell on the server, then call it up to run commands.
The flaw was patched on August 19 in Elementor Pro 4.2.2. Everything on 4.2.1 and earlier is vulnerable.
A one word bug in a validation loop
Elementor Pro runs on more than 6 million WordPress sites, and the bug, tracked as CVE-2026-32475 and rated 9.8 out of 10, sits in the code that vets files submitted through the plugin's form widget. Wordfence describes the cause precisely: the validation loop in Upload::validation() uses "return" where it should use "continue". When the first element of an upload field arrives with no file attached, the function abandons the whole field instead of moving on to the next element, so the extension and file type checks never run on anything else in it.
An unauthenticated attacker, meaning anyone at all, can therefore attach a file with any extension including .php and have it written to the server. That is remote code execution, and as Wordfence puts it, complete site compromise through the use of webshells and other techniques.
Not every Elementor Pro site is exposed
The install count is not the exposure count. Exploitation requires the target to have published a page carrying an Elementor Pro Form widget with at least one file upload field that is not marked as required. A site using the plugin without such a form is not reachable this way, which is worth establishing before anyone reads the 6 million figure as a victim count.
The requests Wordfence captured are POSTs to /wp-admin/admin-ajax.php with the action parameter set to elementor_pro_forms_send_form. The upload field is submitted as an array: the first element carries an empty filename, which is what trips the bailout, and the second carries the payload under a .php filename. Wordfence redacted the webshell body rather than publish working exploit code.
Where the webshell lands
A successful upload is written to /wp-content/uploads/elementor/forms/ under a random filename that keeps the attacker's .php extension, ready to be requested directly. That directory exists to hold form submissions and should never contain a PHP file, so any .php file sitting in it is a strong indicator of compromise. Wordfence also recommends reviewing web server access logs for admin-ajax.php requests carrying that action parameter, and cautions that finding nothing there does not prove a site is clean.
The sources it is currently blocking most heavily, with approximate request counts:
- 2602[:]fa59[:]10[:]7a1[:][:]1, over 28,000 blocked requests
- 185[.]196[.]220[.]85, over 23,800
- 103[.]84[.]230[.]85, over 23,600
- 103[.]90[.]148[.]202, over 15,300
- 216[.]126[.]225[.]208, over 15,000
Update to 4.2.2, then check the uploads folder
Install Elementor Pro 4.2.2 or later. A firewall rule is not a substitute here, and Wordfence notes that its own block on executing an uploaded PHP file only holds when the "Disable Code Execution for Uploads directory" option is switched on. Any site that sat unpatched with an eligible form between August 19 and today should be treated as possibly compromised, which means auditing that uploads directory and hunting for backdoors rather than simply updating and moving on.
The write up is by Wordfence's Istvan Marton, and the vulnerability was reported by Tin Pham (TF1T) and Austin Ginder, who shared a 15,600 dollar bounty. Read the original report for the full attack data. We covered the disclosure itself back in August, and the shape is becoming familiar: a plugin with millions of installs ships a file upload check that can be talked out of checking, much as Gravity Forms did. Here, though, there was no window to patch in. The fix and the first exploit attempts arrived on the same day.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.