Elementor Pro Sites Are Being Hacked: What to Check Right Now

If your site runs Elementor Pro, stop and check it now. There's a serious hole in the plugin, and attackers are already using it to take sites over completely. WordPress security firm Defiant (the company behind Wordfence) has warned that a critical Elementor Pro vulnerability is being exploited in the wild, and the fix has been out since August. If you haven't updated, you're a target.

The flaw sits in the paid version of Elementor, the drag-and-drop builder that runs a huge chunk of the WordPress web. The free plugin has over 10 million installations. Elementor Pro, the paid version, has over 6 million active installations. That's a lot of sites, and a good number of them are still exposed.

Key takeaways

• The bug is tracked as CVE-2026-32475, with a CVSS score of 9.8 (critical). It lets an unauthenticated attacker upload a malicious file and run their own code on your server.
• It affects all Elementor Pro versions up to 4.2.1 and was patched in version 4.2.2 on 19 August. Update immediately if you haven't.
• As of 4 September, roughly two-thirds of Elementor's 10 million installations were still running a vulnerable version.
• Defiant has already blocked over 190,000 exploit attempts. A second related flaw in the Super Forms plugin pushes the combined attack total past 440,000.
• The tell-tale sign of a hack is a PHP file sitting in /wp-content/uploads/elementor/forms/. If you find one, treat the site as compromised.

What the vulnerability actually does

Elementor Pro comes with a Form widget, and that widget supports File Upload fields, the kind that let a visitor attach a document or image when they submit a form. That upload feature is where things go wrong.

Normally, when you submit a form, the plugin runs your files through a set of validation checks before doing anything with them. The problem is in how that validation loop handles an empty upload slot. When it hits a slot marked as empty, it throws an error and returns early, which stops it checking any of the other files in that same field.

The sensible behaviour would be to just skip the empty slot and carry on checking the rest. Instead, the checks never get applied to the remaining files. That's the whole flaw in a sentence: one empty slot switches off the security checks on everything after it.

An attacker exploits this by submitting an upload field as an array with two parts. First an empty slot, which triggers the early return and kills validation. Then a PHP payload, which slips through completely unchecked. The part of the plugin that processes the field correctly skips the empty slot and processes the second, unvalidated part, so the attacker's file gets written straight to disk.

Once that PHP file is on your server, the attacker can simply request it in a browser and make the server run it. As Defiant puts it, an unauthenticated attacker can execute their PHP payload on the server, which can lead to full site compromise. No login required, no user account, nothing. That's why this scores 9.8 out of 10.

How bad is the exposure

Bad enough to act today. Wordfence disclosed the flaw as an "unrestricted file type upload" affecting all versions up to and including 4.2.1. To be exploitable, a site needs to have published a page containing an Elementor Pro Form widget with at least one non-required File Upload field. That's a common enough setup, contact forms, application forms, quote requests, that plenty of sites will match it.

Defiant says threat actors started exploiting the flaw immediately after the fix landed, which is exactly what you'd expect. Attackers watch patch releases closely, because a patch tells them precisely where the hole is and which sites haven't closed it yet. The firm has blocked over 190,000 exploit attempts so far.

Here's the number that should worry you most: according to WordPress data, roughly two-thirds of Elementor's 10 million installations were still running a vulnerable version as of 4 September. It's unclear exactly how many of the 6 million-plus Elementor Pro sites are affected, but the pattern is clear. A serious fix has been available for weeks, and most sites still haven't applied it.

Update to 4.2.2 straight away

The fix is simple. Update Elementor Pro to version 4.2.2 or later. Go to your WordPress dashboard, open Plugins, find Elementor Pro, and run the update. If your dashboard shows Elementor Pro at 4.2.1 or below, you're still exposed.

A quick word of caution: on a live business site, don't blind-update a major plugin without a backup and, ideally, a quick test. Elementor sits at the core of how your pages are built, so a bad update can visibly break layouts. Take a full backup first, update, then click through your key pages to check nothing's shifted. If you're nervous about doing that on production, this is exactly the sort of job a proper website maintenance plan handles quietly in the background, updating, testing and rolling back if anything looks off.

And because attackers moved the moment the patch dropped, updating alone isn't the end of it. If your site was vulnerable and exposed before you updated, it may already have been hit. You need to check.

How to check if you've already been hacked

Successful exploitation writes a PHP file into the /wp-content/uploads/elementor/forms/ directory, the folder that stores uploaded form submissions. That folder should never contain PHP files. It holds documents and images people have submitted, not code.

So the check is straightforward:

1. Look in /wp-content/uploads/elementor/forms/ using your hosting file manager, SFTP, or a file-browser plugin. The presence of any PHP file in there is a strong indicator of compromise.
2. Check your server logs for requests to /wp-admin/admin-ajax.php, which is the endpoint the form submissions run through. Unusual bursts of requests there are worth a closer look.
3. If you find evidence of compromise, check the whole site for backdoors. Attackers rarely stop at one file. Once they can run code, they'll often plant extra hidden files and rogue admin accounts so they can get back in even after you clean up the obvious file.

If you do find a PHP file where there shouldn't be one, don't assume deleting it fixes everything. Treat the site as compromised, take it offline if you can, and work through a proper cleanup. Our practical guide to WordPress malware removal walks through how to find and remove the mess a hack like this leaves behind, including the backdoors that get overlooked.

It's not just Elementor: Super Forms too

Wordfence disclosed a second critical flaw at roughly the same time, in a plugin called Super Forms, another drag-and-drop form builder. It has around 13,000 active installations, far smaller than Elementor, but the story is the same.

Super Forms contained an arbitrary file upload bug in all versions up to and including 6.3.313. It's tracked as CVE-2026-14894, also carries a 9.8/10 critical severity score, and was also patched a few weeks ago. Wordfence observed more than 250,000 exploitation attempts against this one, which together with the Elementor attacks brings the combined total past 440,000 already.

The common thread here is file uploads. Both bugs let unauthenticated attackers upload files that may be executable, which opens the door to remote code execution. If you run either plugin, apply the fix without delay.

Why this keeps happening to WordPress sites

None of this is really about Elementor being badly built. It's about scale and speed. Popular plugins are attractive targets precisely because they're everywhere, and attackers automate the whole thing. They scrape disclosure notices, work out where the flaw is, and hammer millions of sites hoping to find the ones that haven't patched. That two-thirds figure is the reason it works.

The uncomfortable truth is that the window between "patch released" and "exploitation begins" is now basically zero. Waiting until your monthly catch-up to run plugin updates isn't good enough when a critical file-upload flaw is in play. This is the whole argument for keeping WordPress properly maintained rather than leaving it to look after itself, and it's a theme we keep coming back to in our overview of what WordPress maintenance actually needs doing in 2026.

If you build sites on WordPress, a form widget with a file upload field is a completely normal thing to want. The lesson isn't to avoid them. It's to make sure someone is watching for exactly this kind of announcement and acting on it fast, ideally the same day.

What to do today

Quick recap, in order:

1. Check your Elementor Pro version. If it's 4.2.1 or below, back up and update to 4.2.2 or later.
2. Check Super Forms too if you run it, and update past 6.3.313.
3. Look inside /wp-content/uploads/elementor/forms/ for any PHP files.
4. If you find one, assume you've been breached, check your logs and scan for backdoors and rogue admin accounts.

If that list makes you nervous, or you'd rather someone handled the update, the compromise check and any cleanup properly, that's exactly what our website maintenance service is for. Get in touch and we'll check your site, patch what needs patching, and keep on top of the next one before it becomes a problem.