Elementor Pro CVE-2026-32475: Active Exploitation of PHP Web Shell via Array Validation Bypass

Critical security flaw CVE-2026-32475 discovered in Elementor Pro version 4.2.1 allows attackers to gain unauthorized access to WordPress sites. Wordfence blocked over 190,000 attack attempts exploiting the validation bypass, but these figures do not indicate successful compromises. Unauthenticated attackers can exploit the vulnerability by sending a multipart request to public Elementor Pro forms, which must not have mandatory File Upload fields.

By submitting the File Upload field as an array with an empty first element, the extension and file type checks are bypassed. If PHP execution is enabled in the target directory, the PHP file is saved with a random name and .php extension. Successful uploads lead to arbitrary command execution on the web server, potentially resulting in site defacement, credential theft, or malware distribution.

To mitigate the risk, update to version 4.2.2 or later, disable PHP execution in the upload directory, and block executable file uploads via a Web Application Firewall.