A vulnerability in the WordPress plugin Elementor Pro has exposed 6 million websites to the virus.

A critical security flaw has been discovered in the widely used WordPress plugin Elementor Pro, potentially compromising six million websites. The vulnerability allows unauthorized attackers to upload arbitrary files, including executable PHP files, without prior authentication, posing a serious risk to affected sites. The issue was identified by cybersecurity firm Wordfence, which warned users of the potential for complete takeover of vulnerable WordPress installations through this exploit. The flaw stems from a logic error in the file upload validation process within Elementor Pro’s form widgets. Specifically, if a page contains an Elementor Pro form widget with at least one file upload field, even if it is not marked as required, an attacker could exploit the vulnerability. This weakness is catalogued under CVE-2026-32475 and carries a CVSS score of 9.8, indicating a high severity level. The vulnerability is rated as critical due to its potential to allow remote code execution. Wordfence disclosed the flaw after receiving it through its bug bounty program, where the researcher was awarded $15,600, a notably high sum that underscores the real-world impact of the vulnerability. The company informed the Elementor team in early July, and as of Wednesday, August 19, the patched version 4.2.2 is available for download. Administrators are urged to check whether their installations are already up to date and apply the update promptly to mitigate the risk. This discovery follows similar vulnerabilities found in other popular WordPress plugins such as Forminator Forms and Royal Elementor Addons. Both of these plugins have more than 600,000 active installations each, making them similarly susceptible to attacks involving unauthorized file uploads. In those cases, attackers could inject malicious code into websites without needing user credentials, leading to full system compromise. The widespread use of Elementor Pro makes this vulnerability particularly concerning. With over six million active installations, the potential attack surface is vast. If left unpatched, the flaw could enable cybercriminals to deploy malware, steal sensitive data, or take control of entire websites. The ease with which the exploit can be carried out further heightens the urgency for administrators to update their systems. Security experts recommend that all users of Elementor Pro immediately review their site configurations and ensure they are running the latest version of the plugin. Additionally, regular backups and monitoring for unusual activity should be part of routine website maintenance. While the availability of the updated version provides a clear path forward, the speed of adoption among users will determine how effectively the threat is mitigated. As the cybersecurity landscape continues to evolve, staying proactive in addressing known vulnerabilities remains essential for maintaining the integrity of web platforms.