CVE-2026-32475
CVSS 9 CRITICAL: unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious… EPSS 2% (80th percentile).
Vulnerabilities · 53 days ago
Wordfence says attackers have now launched more than 440,000 exploit attempts against Super Forms and Elementor Pro, turning two WordPress plugin flaws into a mass abuse campaign. The Super Forms issue is CVE-2026-14894, fixed in 6.3.314, and the Elementor Pro issue is CVE-2026-32475, fixed in 4.2.2.
Both bugs let an unauthenticated attacker upload a PHP file as if it were ordinary form content. Once that file lands where the site can serve it, it runs like code, so the next step is often a web shell that can create admin accounts, steal data, and seize the site.
For WordPress sites that expose public file-upload forms, the exposure is no longer a one-off disclosure on a single plugin. Any unpatched instance with the vulnerable form path still reachable is sitting in a live bot-driven takeover window, and cleanup gets harder once a shell has already been planted.
CVSS 9 CRITICAL: unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious… EPSS 2% (80th percentile).
3 sources covering this story
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Attackers are exploiting Super Forms and Elementor Pro flaws to upload PHP files and execute code on WordPress sites.
Critical Elementor Pro flaw exploited to take over WordPress sites
A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.
Part of the PlainSec briefing for 2026-09-07