A critical vulnerability in Elementor Pro, the WordPress page-builder plugin, is being actively exploited against sites that use certain form-upload configurations, according to BleepingComputer. The flaw, tracked as CVE-2026-32475, can let attackers upload a PHP payload and execute arbitrary commands on the server. BleepingComputer reports that Elementor Pro has more than 6 million active installations. The issue affects versions 4.2.1 and earlier and was patched on August 19 with Elementor Pro 4.2.2. The reported bug sits in how Elementor Pro validates file-upload arrays in forms. According to BleepingComputer’s summary of Wordfence’s analysis, an attacker can submit an upload field as an array with an empty first element and a malicious PHP file as the second element. That structure can cause later files in the upload set to avoid the expected validation path. If the attack succeeds, the PHP payload is written under /wp-content/uploads/elementor/forms/ with a randomly generated filename while retaining the attacker-supplied .php extension, according to the report. The attacker can then request that file directly and use it to execute commands remotely on the server. The exploitation path is not universal to every Elementor Pro installation. BleepingComputer reports that a target site must have a published Elementor Pro Form widget with at least one File Upload field. The report describes that setup as common, which helps explain why the flaw is operationally meaningful even if it requires a specific configuration. Wordfence said exploitation activity began on August 19, the same day Elementor released the patched 4.2.2 version, according to BleepingComputer. Since then, Wordfence’s web application firewall has blocked almost 200,000 exploitation attempts against its clients, including more than 190,000 attempts between August 19 and 23. Patchstack had warned last month that the flaw could be used to upload arbitrary PHP files and trigger PHP execution on the server, BleepingComputer reports. Wordfence also provided a list of IP addresses tied to thousands of attacks so defenders could add them to blocklists. For site operators, the immediate remediation is narrow and concrete: upgrade Elementor Pro to 4.2.2 or later. BleepingComputer also says administrators should inspect /wp-content/uploads/elementor/forms/ for unexpected PHP files; because that directory is used for form submissions, the presence of a PHP file there is a strong sign that cleanup and incident response may be needed. Who benefits: Defenders benefit from the specific indicators and upgrade path: Elementor Pro 4.2.2 or later, plus inspection of the Elementor forms upload directory. Web application firewall users may also benefit from rules that already block this exploit pattern, according to Wordfence’s reported activity. Who's exposed: WordPress sites running Elementor Pro 4.2.1 or earlier are exposed if they have a published Form widget with at least one File Upload field. Sites that delayed patching after August 19 should treat the directory check as part of remediation, not an optional follow-up.