CVE-2026-32475: Elementor Pro Arbitrary File Upload Exploited in the Wild — Detection and Remediation Guide for WordPress Defenders

WordPress defenders have a familiar but critical problem on their hands. CVE-2026-32475, a CVSS 9.8 (Critical) arbitrary file upload vulnerability in Elementor Pro — one of the most widely deployed WordPress plugins in the world — is being actively exploited to compromise websites, per SecurityWeek's reporting.

The flaw lives in the function that handles form submissions in Elementor Pro. That detail matters enormously: forms are the plugin's most internet-facing feature. Contact forms, file upload forms, lead capture forms — these are unauthenticated, high-traffic endpoints by design. A critical file upload bug in that code path means an unauthenticated remote attacker can push a malicious file (read: a PHP webshell) onto your web server and achieve remote code execution as the web server user.

If you run Elementor Pro anywhere in your fleet — marketing sites, customer portals, landing page infrastructure — assume you are a target. Mass exploitation of WordPress plugin vulnerabilities typically begins within hours to days of public disclosure, and reporting confirms exploitation is already happening. Treat this as an incident-response-level event, not a routine patch Tuesday item.

Technical Analysis

Affected Component and Attack Surface

• Product: Elementor Pro (WordPress plugin, commercial add-on to the free Elementor page builder)
• Vulnerability type: Arbitrary file upload (CWE-434: Unrestricted Upload of File with Dangerous Type)
• CVE: CVE-2026-32475
• CVSS: 9.8 (Critical) — consistent with an unauthenticated, network-exploitable flaw yielding code execution
• Vulnerable function: The server-side handler that processes Elementor Pro form submissions, including forms configured with file upload fields
• Exploitation status: Confirmed active exploitation in the wild per SecurityWeek's reporting. Treat as such even before formal CISA KEV listing — check the CISA Known Exploited Vulnerabilities catalog for updates.

How the Attack Works (Defender's View)

Arbitrary file upload vulnerabilities in WordPress form handlers follow a well-worn exploitation chain. The typical root causes, any of which may be at play here:

1. Missing or bypassable extension/MIME validation. The form handler trusts the client-supplied filename or Content-Type header rather than validating against a server-side allowlist. An attacker uploads shell.php (or shell.php.jpg, shell.phtml, shell.php5, shell.phpt) while claiming it's an image.
2. Extension checks defeated by double extensions or case manipulation, or by servers configured to execute alternate PHP extensions.
3. The uploaded file lands in a web-accessible directory. WordPress uploads go to wp-content/uploads/ by default. If the server executes PHP from that path (common default on Apache/mod_php and many shared hosts), the attacker now has code execution by simply requesting the uploaded file over HTTP.
4. Post-exploitation: the dropped file is typically a webshell (WSO, FilesMan, p0wny, or custom). From there: lateral movement within the hosting account, credential harvesting from wp-config.php (database creds, auth keys), SEO poisoning, redirect injection, or full site defacement/ransom of the underlying host.

Observable Indicators of Exploitation

These are the artifacts your SOC should be hunting for right now:

• HTTP POST requests to Elementor Pro form endpoints — typically /wp-admin/admin-ajax.php with an action parameter referencing Elementor Pro forms, or REST-style endpoints under /wp-json/elementor/. Multipart POST bodies with unusually large or executable-looking filename= values are high signal.
• New executable files under wp-content/uploads/ — any .php, .phtml, .php3-.php7, .phar, or .htaccess file appearing in the uploads tree is effectively a smoking gun. Elementor forms may also stage files under plugin-specific subdirectories.
• Web server process spawning child processes — php-fpm/apache2/nginx worker spawning bash, sh, curl, wget, python, or nc indicates post-webshell activity.
• Outbound connections from the web server to unfamiliar IPs following a suspicious upload.

Detection & Response

Sigma Rules

The following rules target the most reliable observable behaviors: executable files written into WordPress upload paths, and the web server spawning shells (post-exploitation). These are high-fidelity in most environments — legitimate PHP processes do not spawn interactive shells, and uploads directories should never contain PHP files.

---
title: Executable File Written to WordPress Uploads Directory
id: 3f8a2c71-9b4e-4d6a-ae71-2c5d8f1a9b30
status: experimental
description: Detects PHP or other executable files being written into WordPress content/uploads paths, consistent with webshell deployment via arbitrary file upload vulnerabilities such as CVE-2026-32475 in Elementor Pro.
references:
  - https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/plugins/elementor-pro/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.htaccess'
  condition: selection_path and selection_ext
falsepositives:
  - Rare; legitimate plugins occasionally write .htaccess for access control. PHP files in uploads are almost never legitimate.
level: critical
---
title: Web Server Process Spawning Shell or Download Utility
id: 8c1d4e62-7a3b-4f95-b02e-9d6c3a7e5f41
status: experimental
description: Detects web server or PHP-FPM worker processes spawning shells, download tools, or interpreters — a strong post-webshell indicator following exploitation of WordPress file upload flaws such as CVE-2026-32475.
references:
  - https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Some WordPress plugins shell out to curl for cron/tasks; tune against known plugin behavior. Shells (sh/bash) spawned by PHP-FPM are almost always malicious.
level: high
---
title: Suspicious Upload Filename in Elementor Form Submission Request
id: 5e9b7f14-2d8c-4a61-bf39-7e2c4d8a6b52
status: experimental
description: Detects inbound HTTP multipart form submissions to WordPress AJAX/Elementor endpoints where the uploaded filename carries an executable or double extension, consistent with CVE-2026-32475 exploitation attempts. Requires web/proxy logging with URI and filename visibility.
references:
  - https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - 'admin-ajax.php'
      - '/wp-json/elementor'
  selection_method:
    cs-method: 'POST'
  selection_filename:
    cs-body|contains:
      - 'filename="'
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_uri and selection_method and selection_filename
falsepositives:
  - Tune based on your WAF/reverse proxy field schema; requires request body logging, which many environments restrict. Deploy at the WAF layer (ModSecurity/Cloudflare) where possible.
level: high

KQL — Microsoft Sentinel Hunt

Most WordPress fleets log to Sentinel via Syslog/CEF ingestion from the web host or WAF. The first query hunts web server process spawning (Syslog ProcessCreate-style data via the Syslog table or CommonSecurityLog from a WAF); the second hunts suspicious uploads against Elementor endpoints in CommonSecurityLog.

// Hunt 1: Inbound POSTs to Elementor/WordPress AJAX endpoints with executable upload filenames
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod == "POST"
| where RequestURL has_any ("admin-ajax.php", "/wp-json/elementor")
| where AdditionalExtensions has_any (".php", ".phtml", ".phar", ".php5", ".php7")
   or RequestContext has_any (".php", ".phtml")
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, DestinationHostName, DeviceAction, AdditionalExtensions
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, RequestURL
| order by Requests desc

// Hunt 2: Web server spawning shells or download tools (Syslog-ingested auditd/process logs)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("php-fpm", "apache2", "httpd", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc -", "python")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

// Hunt 3: DeviceProcessEvents — web stack spawning suspicious children (if Defender for Endpoint is on the host)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx", "php")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

Velociraptor VQL — Hunt for Webshell Artifacts

If you have Velociraptor deployed on your web hosts (strongly recommended for exactly this scenario), hunt for executable files in uploads paths and web-stack-spawned processes:

-- Hunt for PHP/executable files in WordPress uploads directories (webshell artifacts)
-- and web server processes spawning shells

SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/wp-content/uploads/**/*.php',
                 '/var/www/**/wp-content/uploads/**/*.phtml',
                 '/var/www/**/wp-content/uploads/**/*.phar',
                 '/home/**/wp-content/uploads/**/*.php',
                 '/srv/**/wp-content/uploads/**/*.php'])
ORDER BY Mtime DESC

-- Web server process spawning shells or download utilities (post-exploitation)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(php-fpm|apache2|httpd|nginx)'
   OR Name =~ '^(sh|bash|dash|curl|wget|nc|ncat|python3?)$'
ORDER BY CreateTime DESC

Remediation and Verification Script

Run the following Bash script on affected web hosts (or across your fleet via Ansible/your config management of choice). It inventories Elementor Pro versions, scans uploads trees for webshell indicators, checks for .htaccess tampering, and flags recently modified PHP files.

#!/bin/bash
# CVE-2026-32475 — Elementor Pro verification and triage script
# Run as root or with read access to WordPress installations

WP_ROOTS=$(find /var/www /home /srv -maxdepth 6 -type f -name "wp-config.php" 2>/dev/null | xargs -r dirname)

echo "=== [1] Elementor Pro version inventory ==="
for root in $WP_ROOTS; do
  PLUGIN="$root/wp-content/plugins/elementor-pro/elementor-pro.php"
  if [ -f "$PLUGIN" ]; then
    VER=$(grep -i "Version:" "$PLUGIN" | head -1 | awk '{print $2}')
    echo "[!] Elementor Pro FOUND: $root — version $VER"
  fi
done

echo "=== [2] Scanning uploads directories for executable files (webshell indicators) ==="
for root in $WP_ROOTS; do
  find "$root/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" \
    -o -name "*.phar" -o -name "*.php5" -o -name "*.php7" -o -name "*.php3" \) \
    -printf "%T+ %p\n" 2>/dev/null | sort -r | head -50
done

echo "=== [3] PHP files modified in the last 14 days anywhere under wp-content ==="
for root in $WP_ROOTS; do
  find "$root/wp-content" -type f -name "*.php" -mtime -14 -printf "%T+ %p\n" 2>/dev/null | sort -r | head -50
done

echo "=== [4] Unexpected .htaccess files under uploads ==="
for root in $WP_ROOTS; do
  find "$root/wp-content/uploads" -name ".htaccess" -exec sh -c 'echo "--- {} ---"; cat "{}"' \; 2>/dev/null
done

echo "=== [5] Hardening check: does uploads .htaccess disable PHP execution? ==="
for root in $WP_ROOTS; do
  HT="$root/wp-content/uploads/.htaccess"
  if [ -f "$HT" ] && grep -qi "php_flag engine off\|deny from all\|Require all denied" "$HT"; then
    echo "[OK] PHP execution disabled in $HT"
  else
    echo "[WARN] No PHP execution hardening found for $root/wp-content/uploads"
  fi
done

echo "=== Done. Investigate any executable files or recently modified PHP before patching. ==="

If the script surfaces PHP files in uploads paths, preserve them as forensic evidence before deletion — hash them, capture timestamps, and image the host if this is a production system. A webshell means you are scoping a compromise, not just patching a bug.

Remediation

1. Update Elementor Pro immediately to the latest patched release available through your Elementor account / WordPress plugin updater. Because exploitation is confirmed in the wild, this is an emergency change — deploy outside the normal change window. Verify the update actually applied; auto-updates for commercial plugins fail silently more often than they should when license keys lapse.
2. Check Elementor's official advisory and changelog at elementor.com and the plugin's changelog for the fixed version number, then validate every instance in your fleet (including staging, dev, and forgotten microsites — attackers don't distinguish).
3. Hunt before and after patching. Patching stops new exploitation; it does nothing about webshells already dropped. Run the script above and the Sigma/KQL detections against historical logs. If you find artifacts, escalate to full IR: rotate database credentials and WordPress auth keys/salts in wp-config.php, force password resets for admin users, and audit for rogue administrator accounts.
4. Harden the uploads directory so PHP never executes there regardless of future plugin bugs. For Apache, place an .htaccess in wp-content/uploads denying execution; for Nginx, add a location block returning 403 for PHP under uploads:

# Apache — /wp-content/uploads/.htaccess
cat > /var/www/html/wp-content/uploads/.htaccess <<'EOF'
php_flag engine off
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
  Require all denied
</FilesMatch>
EOF

# Nginx — inside the server block:
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ { deny all; }

5. Deploy WAF virtual patching (ModSecurity/CRS, Cloudflare, or your edge WAF) to block multipart POSTs to Elementor endpoints carrying executable filenames while you roll the patch out.
6. Restrict admin-ajax.php and REST exposure where business logic allows, and ensure file upload fields in Elementor forms enforce strict server-side allowlists (images/documents only) after patching.
7. Monitor CISA KEV. Given confirmed active exploitation and a 9.8 score, expect a KEV listing with a federal remediation deadline; use it as ammunition for change-freeze exceptions.

If You Suspect Compromise

Do not just patch and move on. A successful arbitrary file upload on a WordPress host typically yields full read access to wp-config.php (database credentials, salts), the ability to inject admin users, and persistence beyond the original webshell (malicious plugins, mu-plugins, cron entries, modified core files). Minimum IR scope: file integrity comparison against a known-good backup, user account audit, credential rotation, and egress log review for data staging. If the site handles e-commerce (WooCommerce) or any regulated data, assess notification obligations under PCI-DSS or applicable privacy law.

Bottom Line

CVE-2026-32475 is the exact class of vulnerability that turns a marketing website into a beachhead: unauthenticated, form-facing, trivially weaponized, and already being exploited. Patch Elementor Pro today, harden PHP execution in uploads permanently, and hunt for webshells retroactively — the exploitation window almost certainly predates the disclosure.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub