Reports indicate that a critical arbitrary file upload vulnerability within the Elementor Pro WordPress plugin is currently being actively exploited to compromise websites. The flaw, identified as CVE-2026-32475, allows attackers to upload malicious files to affected sites, potentially leading to full site compromise.
The vulnerability resides specifically within the Elementor Pro plugin's form submission handling function. This mechanism, intended to process user input and manage file uploads for legitimate purposes, contains a weakness that attackers can leverage. By manipulating the input to this function, malicious actors can bypass intended restrictions and upload arbitrary files, rather than just the file types or sizes expected by the plugin.
An arbitrary file upload vulnerability of this nature is particularly severe because it grants attackers a high degree of control over the compromised server. Once a malicious file, such as a web shell, is uploaded, it can be executed to perform various actions. These actions could include defacing the website, injecting malware, stealing sensitive data from the site's database, or even using the compromised server as a launchpad for further attacks.
Elementor Pro is a widely used premium page builder plugin for WordPress, extending the platform's capabilities with advanced design and functionality features. Given its extensive user base, the potential scope of this exploitation campaign is significant. Websites utilizing vulnerable versions of the plugin are at risk, and the active exploitation suggests that attackers are specifically targeting this flaw.
Mitigation for this class of vulnerability typically involves updating the affected software to a patched version as soon as one becomes available. In the interim, website administrators might consider implementing Web Application Firewalls (WAFs) to detect and block malicious file upload attempts. Additionally, regularly backing up website data and enforcing strong security practices, such as least privilege access and robust password policies, are crucial for overall site security.
This incident underscores the ongoing challenges in securing web applications, particularly those built on popular content management systems with extensive plugin ecosystems. The active exploitation of a critical vulnerability in a widely adopted plugin highlights the need for continuous vigilance, prompt patching, and a layered security approach to protect against evolving cyber threats.
