Elementor Pro CVE-2026-32475: Active Exploitation of PHP Web Shell via Array Validation Bypass

Posted on by — No Comments ↓

1. Overview

  • Title: Critical Elementor Pro flaw exploited to take over WordPress sites
  • Source: BleepingComputer
  • Published Date: 2026-09-03
  • Original Link: BleepingComputer
  • Related Sources: Wordfence exploitation analysis
  • Related Malware / Threat Actors / CVEs / Products: CVE-2026-32475, PHP web shells, WordPress, Elementor Pro versions up to 4.2.1
  • Severity: Critical
  • Review Update: Content reviewed on 2026-09-05: Clarified block counts versus successful compromises, malicious uploads versus code execution, pre-conditions such as optional File Upload fields, facts versus inferences, and Japanese phrasing. Revised “Victim / Administrator Perspective” to focus on observable events on screens, logs, and devices, along with their observation conditions.

2. Executive Summary

Wordfence blocked over 190,000 attack attempts exploiting a file validation flaw in Elementor Pro to upload PHP files. While this leads to arbitrary code execution in configurations that allow PHP execution, the blocked count does not represent successful compromises.

3. Attack Flow

Observed Validation Bypass Attempts and Execution Path on Success

  1. An unauthenticated attacker sends a multipart request to a public Elementor Pro Form containing a File Upload field. The target field must not be set as mandatory for this to succeed.
  2. The attacker submits the File Upload field as an array, leaving the first element empty to trigger UPLOAD_ERR_NO_FILE.
  3. Upload::validation() exits via return, skipping the extension and file type checks for subsequent elements.
  4. Upon successful upload, the subsequent PHP file is saved under /wp-content/uploads/elementor/forms/ with a random name and a .php extension.
  5. If PHP can be executed in the destination directory, the attacker requests the file directly to achieve arbitrary command execution. The published block counts do not indicate success at this stage.

4. Threat Actor Position and Execution Location

  • Unauthenticated external attackers who can reach the target WordPress site’s public forms and admin-ajax.php. The execution location for PHP is the target web server.

5. Victim and Administrator Perspective

Victim

  • Inference: The attack requires no user interaction, and victims may remain unaware until site defacement or suspicious redirection occurs.

Administrator

  • Inference: Web server access logs may show POST requests to /wp-admin/admin-ajax.php. If the WAF or similar device records request bodies, logs will show the elementor_pro_forms_send_form action alongside a File Upload field containing an empty file element followed by a .php file element. Access logs without request bodies will not reveal this array structure.
  • Successful malicious uploads result in files with random names and .php extensions saved under /wp-content/uploads/elementor/forms/. The mere presence of the files does not confirm successful PHP execution.
  • Inference: If the attacker accesses the saved PHP file, direct requests to that file may appear in access logs. Request records alone do not confirm successful PHP execution.
  • Inference: If OS command execution is reached and process creation is collected, EDR tools may record shells or download tools spawned by the PHP processing process.

6. Success and Failure Conditions

Success Conditions

  • Elementor Pro versions 4.2.1 and earlier are running.
  • A public page contains an Elementor Pro Form with at least one File Upload field not set as mandatory.
  • Achieving arbitrary code execution requires the upload directory to permit PHP execution.

Failure / Mitigation Conditions

  • Update to fixed versions 4.2.2 or later.
  • Disable script execution, such as PHP, in the upload directory. This is distinct from preventing malicious file uploads themselves.
  • Block the upload of executable files via a WAF or similar control. Do not block normal form submissions uniformly based solely on an array format.

7. What Happens on Success

  • If the attack succeeds, arbitrary code and commands may be executed on the web server.
  • A PHP web shell may be deployed for persistent access to the site.
  • Inference: This may lead to site defacement, credential and database theft, or malware distribution to visitors. The published block counts do not indicate whether these impacts occurred.

8. Observable Logs

  • Email: None.
  • Proxy / SWG / DNS: Web server, reverse proxy, and WAF logs: multipart POSTs to admin-ajax.php and GET requests to PHP files under uploads/elementor/forms/. DNS logs alone cannot show file paths or request bodies.
  • Endpoint / EDR: Inference: Check for the creation and execution of PHP files under uploads, and verify the spawning of shells or download tools from php-fpm or Apache/web processes. Examine process lineage based on actual configurations.
  • Identity / IdP: Inference: Check for unauthorized creation of WordPress administrators or logins following a compromise.
  • SaaS / Cloud: WAF logs showing blocked file uploads.
  • SaaS / Cloud: Inference: Check hosting environment file audits and WordPress operation audits.
  • Network: Inference: Check for C2 communication or file retrieval from the web server to unknown destinations.

9. Determining Attack Success

The following criteria are used to investigate individual environments and do not imply that success was observed at all stages in the articles.

  • Attack Attempt Observed (Success Unconfirmed): Identify crafted multipart requests. WAF block records are evidence of attempts and are not included in successful compromises.
  • User Interaction Confirmed: None. No user interaction is required, and this stage is not considered confirmed.
  • Initial Execution Confirmed: Confirm the execution of the PHP code planted by the attack. If only file writes occurred, record as a successful malicious upload with unconfirmed execution, and do not elevate to this stage.
  • Malware Execution or Authentication Success Confirmed: Confirm activity or command execution via PHP web shells using related child processes, execution logs, command outputs, or generated artifacts. Simple GET requests do not confirm this.
  • Information Theft or Session Compromise Confirmed: Confirm unauthorized retrieval or exfiltration of database information or credentials by the attacker.
  • Subsequent Compromise Confirmed: Confirm site defacement, additional backdoors, or internal lateral movement resulting from the attack.

10. Investigation Playbook

Inference: Investigation recommendations based on article observations and feature descriptions.

  • Trigger: Vulnerable plugin versions, abnormal form submissions, suspicious PHP files under uploads.
  • Initial Verification: Preserve plugin versions, form configurations, publication periods, access logs, WAF logs, file contents, and timestamps.
  • Endpoints: Examine uploads/elementor/forms/, core WordPress and plugin diffs, PHP execution processes, and their child processes.
  • Authentication / Cloud: Check for unauthorized use of WordPress administrators, hosting platforms, and database credentials.
  • Subsequent Activity: Track additional web shells, defacements, outbound communications, and visitor malware distribution.
  • Containment: Preserve evidence, isolate and update the affected site, and disable PHP execution in upload directories. Remove suspicious files and rotate credentials that may have been exposed.
  • Judgment Categories: Separate attack requests, successful malicious uploads, PHP execution, OS command execution, information theft, and subsequent compromise. File writes alone do not constitute successful execution.

11. Defense and Detection Ideas

Inference: Operational application proposals below. Do not conclude compromise success based solely on matching individual logs or IOCs.

  • Single Event: Suspicious requests to the same File Upload field as an array where the first element has no file selected and subsequent elements contain a .php file.
  • Single Event: Suspicious PHP file creation under uploads/elementor/forms/.
  • Time-Series Correlation: Correlate crafted POSTs -> PHP creation -> direct GET requests -> execution artifacts -> outbound communication.
  • Hunting: Search for requests to admin-ajax.php since August 19 and suspicious PHP files under uploads.
  • Log Gaps: Lack of request bodies, file creation records, or PHP execution logs makes it difficult to distinguish between validation bypass attempts, successful saves, and successful executions.
  • Priority Actions: Simultaneously pursue emergency updates, disable script execution in upload directories, and check for signs of compromise.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-32475 is an unauthenticated arbitrary file upload vulnerability related to Upload::validation() in Elementor Pro 4.2.1 and earlier, patched in version 4.2.2.
  • When the first array element triggers UPLOAD_ERR_NO_FILE, the validation loop exits via return instead of continue, skipping extension and file type checks for subsequent files.
  • Wordfence demonstrated actual attack requests where the first element had no file selected and the second element contained a .php file.
  • Success requires the public page to host an Elementor Pro Form containing at least one File Upload field not set as mandatory.
  • Upon successful upload, the PHP file is saved under /wp-content/uploads/elementor/forms/. Configurations that allow PHP execution lead to command execution via direct requests.
  • Wordfence observed attacks starting from the disclosure date of August 19, 2026, and blocked over 190,000 attack attempts post-disclosure, with activity concentrating between August 19 and 23.
  • The 190,000+ count represents blocked attack attempts, not successful compromises or affected sites.

Inference

  • Correlating form submissions, suspicious PHP creation, and access to that PHP file provides clues to suspect execution. However, access logs alone cannot confirm successful PHP or OS execution; execution records, responses, or generated artifacts are required.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in “Unknowns and Further Investigation.”

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (High): Corresponds to attack attempts targeting file validation bypass in public forms.
  • T1505.003 Server Software Component: Web Shell (High): Observed attack requests aim to deploy PHP web shells. Installation and execution success on individual sites must be verified separately.
  • T1059.004 Command and Scripting Interpreter: Unix Shell (Medium): Corresponds to invoking OS shells from deployed PHP web shells on Unix servers. This does not imply that OS or command execution success was confirmed across all sites.

14. Unknowns and Further Investigation

  • Number of successfully compromised sites and threat actor attribution.
  • Full variety of PHP payloads used in attacks.
  • Scope of persistence and information theft after web shell deployment.

15. Impact on SOCs and Enterprise Environments

Organizations utilizing Elementor Pro should verify plugin versions and check whether public form File Upload fields are set as mandatory. Apply updates to version 4.2.2 or later, conduct retrospective investigations for suspicious PHP files under /wp-content/uploads/elementor/forms/, crafted submissions to admin-ajax.php, and known attacking IP addresses. Evaluate file writes and PHP execution separately.

16. Summary by Role

  • For SOCs: Correlate form submissions, suspicious PHP file creation, direct access, and execution artifacts. Do not judge code execution as successful based solely on upload success or GET requests.
  • For Administrators: Update to version 4.2.2 or later and disable PHP execution in upload directories. Investigate suspicious files and additional web shells.
  • For Users: The attack requires no user interaction. If site defacement or suspicious redirection is noticed, report it to the site operator.

Leave a Reply