Elementor Pro Sites Are Being Hacked: How to Check and Fix Yours (CVE-2026-32475)

# Elementor Pro Sites Are Being Hacked: How to Check and Fix Yours

**Watch the 1-minute video:**

https://youtu.be/tz8l2w7Qwis

If your WordPress site runs **Elementor Pro**, stop and check it today. A critical vulnerability, **CVE-2026-32475**, lets an attacker upload a PHP file through one of your site’s forms and run it on your server. No account and no login are needed. Once that file runs, the attacker controls the whole site.

This isn’t a lab finding. Defiant, the company behind Wordfence, reported blocking **more than 190,000 attack attempts** against this bug.

## Am I affected?

You are affected if **both** of these are true:

1. Your site runs **Elementor Pro 4.2.1 or older**.

2. A published page uses the **Elementor Form widget with a File Upload field** (contact forms with attachments, job applications, “send us your file” forms).

| | Details |

|—|—|

| CVE | CVE-2026-32475 |

| Plugin | Elementor Pro (the paid version, not the free Elementor plugin) |

| Affected | 4.2.1 and older |

| Fixed in | **4.2.2** (released August 19, 2026) |

| Severity | Critical: CVSS 9.0 (Patchstack) / 9.8 (as reported by SecurityWeek) |

| Found by | Tin Pham, reported through Patchstack |

| Where the payload lands | `wp-content/uploads/elementor/forms/<random-id>.php` |

Even if you’re not sure you have an upload field, update anyway. It costs one click.

## Step 1: Update Elementor Pro to 4.2.2 or newer

**From the dashboard:** go to **Plugins**, find Elementor Pro and click **Update now**. Then check the version number shows 4.2.2 or higher.

**From the terminal (WP-CLI),** inside your site folder:

“`bash

# Check the installed version

wp plugin get elementor-pro –field=version

# Update it

wp plugin update elementor-pro

“`

If you manage many sites, run the same two commands on each one, or use your host’s bulk plugin update tool.

## Step 2: Hunt for backdoors (updating doesn’t remove them)

This is the step most people skip. The update closes the door, but if an attacker already got in before you updated, their file is still sitting on your server.

Elementor saves uploaded form files in `wp-content/uploads/elementor/forms/`. That folder should only contain things like PDFs and images, **never PHP files**.

“`bash

# Should return nothing

find wp-content/uploads/elementor/forms -name “*.php”

# Wider check: any PHP-like file anywhere in uploads since August

find wp-content/uploads -name “*.php*” -newermt “2026-08-01”

“`

– **Empty result:** good, no sign of this attack.

– **Any `.php` file found** (often a random name like `65f1a2b3c4d5e.php`): treat the site as **hacked**. Jump to “If you were hacked” below.

## Step 3: Check your administrators

Attackers often create a new admin account so they can come back later, even after you delete their file.

“`bash

wp user list –role=administrator –fields=ID,user_login,user_email,user_registered

“`

Look at every row. A user you don’t know, an odd email domain, or a registration date after mid-August is a red flag. If you don’t recognize it, delete it (`wp user delete <ID> –reassign=1`) and investigate.

In the dashboard, the same list is at **Users > All Users**, filtered by **Administrator**.

## Bonus: block PHP in the uploads folder

The uploads folder is for media, so there’s no reason for PHP to ever run from it. One small rule stops this entire class of attack, even for future plugin bugs.

**Apache:** create `wp-content/uploads/.htaccess` with:

“`apache

Require all denied

</FilesMatch>

“`

**Nginx:** add this inside your site’s `server { }` block, then run `sudo nginx -t && sudo systemctl reload nginx`:

“`nginx

location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {

deny all;

}

“`

Test it: open `https://your-site/wp-content/uploads/test.php` (it doesn’t need to exist). You should get **403 Forbidden**, not a 404 handled by PHP.

## If you were hacked

1. Take a copy of the malicious file and your server logs for evidence.

2. Put the site in maintenance mode.

3. Delete the backdoor file(s) and any unknown admin accounts.

4. Change **all** admin passwords, the database password, and hosting/FTP/SSH passwords.

5. Rotate the WordPress salts in `wp-config.php` (this logs everyone out).

6. Scan the whole site for other backdoors (a security plugin scan plus `find . -name “*.php” -newermt “2026-08-01″`).

7. If you’re not sure it’s clean, **restore from a backup made before the infection**, then update Elementor Pro before you put it back online.

## Quick checklist

– [ ] Elementor Pro is on **4.2.2 or newer**

– [ ] No `.php` files in `wp-content/uploads/elementor/forms/`

– [ ] Every administrator account is someone you know

– [ ] PHP is blocked in `wp-content/uploads/` (Apache or Nginx rule)

– [ ] Shared this with anyone else who runs a WordPress site

## Sources

– The Hacker News: [Elementor Pro flaw could let attackers take over WordPress sites](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html) (August 20, 2026)

– SecurityWeek: [Elementor Pro WordPress plugin vulnerability exploited to hack sites](https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/) (September 5, 2026)

– WP-CLI docs: [wp plugin](https://developer.wordpress.org/cli/commands/plugin/) and [wp user list](https://developer.wordpress.org/cli/commands/user/list/)

—

**Watch the video:**

https://youtu.be/tz8l2w7Qwis

*Abd Almouhimen Shamout, Take away support: IT fixes, delivered in under two minutes. More at mouhimen.dev.*