Elementor Pro: Critical Flaw Under Active Attack

If your website uses the Elementor Pro page builder, there is an actively exploited security flaw that needs your attention right now. It was patched on 19 August 2026, but attackers started targeting unpatched sites the same day the fix was released — and are still doing so in volume.

What is Elementor Pro?

Elementor Pro is a popular drag-and-drop website builder used on more than six million WordPress sites worldwide. It makes it straightforward to design pages and add features like contact forms and file upload fields without needing to write code. If your website was built or redesigned in the last few years, there is a reasonable chance it runs Elementor Pro.

What is the vulnerability?

The flaw, tracked as CVE-2026-32475, is in the way Elementor Pro handles file uploads through forms. Under normal circumstances, the plugin is supposed to block visitors from uploading potentially dangerous file types such as PHP scripts. However, a bug in the way the validation and file-saving steps work independently means an attacker can trick the plugin into accepting a malicious PHP file by disguising it within a multi-part upload request.

Once the file is on your server, the attacker can request it directly and run arbitrary code — effectively taking full control of the website. This is known as a remote code execution (RCE) vulnerability, and it carries a critical severity rating of 9.0 out of 10.

Crucially, the attack does not require the attacker to be logged in. Any page on your site that contains an Elementor Pro form with a file upload field is a potential entry point.

What has been happening in the wild?

Wordfence, one of the leading WordPress security firms, reported that it blocked nearly 200,000 exploitation attempts in the days following the patch release. That volume signals automated tools actively scanning the internet for unpatched sites. Any site still running Elementor Pro version 4.2.1 or earlier is at risk.

Why does this matter to your business?

A compromised website is more than a technical problem. Attackers who gain access through a flaw like this can:

• Steal customer data, including contact details, enquiry history, or payment information stored on the site
• Plant malware that infects visitors’ devices, potentially causing Google to flag your site as dangerous and driving away customers
• Use the compromised server as a staging point for attacks on other parts of your business network
• Damage your Google rankings and your brand reputation in ways that can take months to recover from

This is not a new type of attack. Earlier this year we wrote about another critical WordPress vulnerability that was actively exploited in a very similar way. The pattern is consistent: attackers identify well-known plugins with public vulnerabilities and scan the internet at scale for sites that have not yet updated.

What we have already done

For clients whose websites we manage and host, we have reviewed all active Elementor Pro installations and confirmed that updates have been applied to version 4.2.2 or later. If you are a System Force client and have any concerns about your website, please get in touch and we will confirm the position for you directly.

What to check if you manage your own website

Log into your WordPress dashboard and go to Plugins, then Installed Plugins. Find Elementor Pro and check the version number. If it shows anything earlier than 4.2.2, update it immediately — you can do this by clicking the “Update now” link next to the plugin listing.

After updating, it is also worth checking the /wp-content/uploads/elementor/forms/ directory on your server for any files ending in .php. These should not be there under normal circumstances. If you find any, it may indicate your site was compromised before you updated, and you should contact an IT security professional for an investigation.

Keeping your website secure for the long term

This incident highlights something we see repeatedly: websites need ongoing attention, not just a one-off setup. WordPress and its plugins require regular updates, security monitoring, and ideally a web application firewall that can block exploit attempts even before a patch is available.

Our IT security services include managed protection for the businesses and websites we support. As part of our managed IT services, we handle patching and monitoring so that vulnerabilities like this are addressed before they become a problem for your business.

If you would like us to review your website’s security or discuss how we can keep your WordPress site protected as part of a wider managed IT arrangement, get in touch at systemforce.co.uk/contact or call us on 01452 701355 for a no-obligation chat.