BleepingComputer (3 September 2026), citing Wordfence, reports active exploitation of CVE-2026-32475 in Elementor Pro for WordPress. Faulty validation of file-upload arrays in Elementor Pro forms (versions 4.2.1 and earlier) lets an attacker submit an empty first array element and a malicious PHP file as the second, so later files skip validation. The payload lands under /wp-content/uploads/elementor/forms/ and can be fetched to run commands.

Elementor shipped 4.2.2 on 19 August 2026, the same day exploitation began according to Wordfence. Wordfence reported more than 190,000 blocked exploitation attempts between 19 and 23 August.

Exploitation needs a published Elementor Pro Form widget with at least one File Upload field. Patchstack disclosed the issue earlier. Upgrade Elementor Pro to 4.2.2 or later; review uploads under elementor/forms for unexpected PHP; keep WAF rules current.

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: BleepingComputer)