Hackers Are Hijacking WordPress Sites Through a Popular Page Builder
A patched Elementor Pro bug is already being used to drop webshells and seize control of websites.
Millions of American websites run on WordPress. Churches, small shops, local papers, school groups, and campaign sites use it because it is cheap and easy. A lot of those sites also run Elementor Pro, a paid drag-and-drop builder with more than six million active installs.
Security firms now say a critical hole in that plugin is being exploited in the wild. The flaw, tracked as CVE-2026-32475, sits in Elementor Pro versions 4.2.1 and earlier. It lives in the Form widget’s file-upload field. An attacker does not need a password. If a published page has a form with an upload box, the attacker can send a crafted request: an empty file first, then a malicious PHP file. The plugin’s checks stop too early, so the bad file gets written to a public folder. The attacker then loads that file and runs commands on the server. That can mean a webshell, stolen data, defaced pages, or a full takeover.
Elementor shipped a fix in version 4.2.2 on August 19, 2026. Attack traffic started the same day. Wordfence says its firewall has already blocked nearly 200,000 exploit attempts. That is not a lab demo. That is mass scanning against real sites.
This is the pattern. A widely used tool ships sloppy validation. Researchers report it. A patch goes out. Criminals copy the details and hit every unpatched site they can find. Small operators update last. They are busy running a business, not reading security blogs. Meanwhile the same internet economy that lectures about “trust and safety” keeps stacking plugins, cloud dashboards, and auto-updates that fail when it counts.
WordPress is not a Silicon Valley toy. It is infrastructure for people who cannot afford a custom app shop. When a builder used by millions leaves an upload check half-finished, the cost lands on the church secretary and the hardware-store owner, not on a campus full of engineers. Big tech and big plugin vendors profit from lock-in and convenience. They are slower to treat security as a duty than as a press release.
Site owners should update Elementor Pro to 4.2.2 or later now. They should also look in /wp-content/uploads/elementor/forms/ for unexpected .php files. A PHP file in that folder is a warning sign. A firewall helps, but it is not a substitute for a patch. Leaving known holes open is how websites get turned into spam mills, malware hosts, or quiet listening posts.
The internet runs on code written by companies that move fast. Ordinary Americans pay the bill when that code is careless.
Sources / More reading
https://orca.security/resources/blog/elementor-pro-wordpress-rce-flaw/