Posted on

Elementor Pro CVE-2026-32475 – Mass Exploitation and Webshell Deployment

Threat Overview

CVE-2026-32475 is a critical unauthenticated arbitrary file-upload vulnerability in Elementor Pro for WordPress. Wordfence reports that Elementor Pro versions 4.2.1 and earlier are affected and that version 4.2.2 contains the security fix. Exploitation requires a published Elementor Pro Form widget containing at least one non-required File Upload field.

The vulnerability exists in form-upload validation. If the first array element has an empty filename and produces UPLOAD_ERR_NO_FILE, validation returns early instead of validating later elements. An attacker can place a PHP payload in a later array element, causing executable PHP to be written into /wp-content/uploads/elementor/forms/ under a randomized filename.

Wordfence states attackers began targeting the issue on August 19, the day of disclosure, and its firewall blocked more than 190,000 exploit attempts. Successful exploitation provides arbitrary PHP execution and complete WordPress-site compromise. Any PHP file in the Elementor forms upload directory is a strong compromise indicator.

References

Impacted Systems

  • Vendor/product: Elementor Website Builder Pro for WordPress.
  • Affected versions: 4.2.1 and earlier according to Wordfence.
  • Patched version: 4.2.2 according to Wordfence.
  • Platform: self-hosted WordPress sites running Elementor Pro.
  • Required configuration: a published Elementor Pro Form widget with at least one non-required File Upload field.
  • Attacker prerequisite: network access to the vulnerable form; authentication is not required.
  • Confirmed upload path after exploitation: /wp-content/uploads/elementor/forms/.
  • Impact: arbitrary PHP upload, RCE, webshell deployment, and full site takeover.
  • Exploitation scale: more than 190,000 blocked exploit attempts reported by Wordfence.

Why This Hunt Was Performed

Elementor Pro has a very large deployment footprint, exploitation is occurring at scale, and the vulnerability provides unauthenticated RCE on Internet-facing WordPress servers.

Criticality

Critical. CVSS 9.8, unauthenticated arbitrary file upload, direct RCE, and confirmed mass exploitation.

Exploitation Status / Threat Activity

Confirmed active exploitation. Wordfence observed attacks beginning August 19, 2026 and reported more than 190,000 blocked attempts.

Scope and Visibility

All hunting and review statements in this report are limited to telemetry ingested into Microsoft Sentinel and the retention available for those data sources. Absence of matching activity in available Sentinel data does not confirm absence of activity on systems that are not monitored, in logs that are not ingested, or outside the retained time window. This daily intelligence package was not executed against a specific customer Microsoft Sentinel workspace, so no customer-specific finding is asserted.

Hunt Scope / What Was Reviewed

Available Microsoft Sentinel telemetry can be reviewed for PHP files in the confirmed Elementor forms upload path, admin-ajax.php form submissions, published attacker IPs, PHP/web-server child processes, executable files in WordPress uploads, webshell requests, new outbound destinations, and Syslog/web-server fallbacks where relevant sources are ingested.

KQL Hunting Content

Hunt 1 – First-Pass: PHP Files in Elementor Forms Upload Directory

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ("/wp-content/uploads/elementor/forms/","\wp-content\uploads\elementor\forms\")
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".php5"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 2 – Elementor Pro Form Submission Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| extend Msg=tostring(column_ifexists("Message",""))
| where Url has "/wp-admin/admin-ajax.php"
| where Msg has "elementor_pro_forms_send_form" or Url has "elementor_pro_forms_send_form"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestMethod=tostring(column_ifexists("RequestMethod","")), Url, RequestClientApplication=tostring(column_ifexists("RequestClientApplication","")), DeviceAction, Msg
| sort by TimeGenerated asc

Hunt 3 – Published Elementor Exploitation Source IPs

let ExploitIPs = dynamic(["2602:fa59:10:7a1::1", "185.196.220.85", "103.84.230.85", "103.90.148.202", "216.126.225.208", "167.254.240.75", "167.254.241.119", "114.10.17.253", "114.10.45.151", "2406:ef80:2:7d19::1"]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP in (ExploitIPs) or DestinationIP in (ExploitIPs)
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, RequestURL=tostring(column_ifexists("RequestURL","")), DeviceAction, Message
| sort by TimeGenerated asc

Hunt 4 – Web Server or PHP Spawning Shells and Downloaders

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("php","php-fpm","php.exe","apache2","httpd","nginx")
| where FileName in~ ("bash","sh","cmd.exe","powershell.exe","pwsh.exe","curl","curl.exe","wget","wget.exe","python","python3","nc","ncat","perl")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 5 – Executable Web Artifacts Created Under WordPress Uploads

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ("/wp-content/uploads/","\wp-content\uploads\")
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar" or FileName endswith ".sh" or FileName endswith ".exe"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 6 – Requests to PHP Files Under Elementor Forms

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where Url has "/wp-content/uploads/elementor/forms/"
| where Url matches regex @"(?i)\.(php|phtml|php5)(\?|$)"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestMethod=tostring(column_ifexists("RequestMethod","")), Url, RequestClientApplication=tostring(column_ifexists("RequestClientApplication","")), DeviceAction
| sort by TimeGenerated asc

Hunt 7 – New Public Destinations From PHP or Web Server Processes

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("php","php-fpm","php.exe","apache2","httpd","nginx")
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("php","php-fpm","php.exe","apache2","httpd","nginx")
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated desc

Hunt 8 – WordPress or PHP Syslog Webshell Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("elementor_pro_forms_send_form","/wp-content/uploads/elementor/forms/","admin-ajax.php")
| where SyslogMessage has_any (".php","POST","GET","system(","shell_exec","passthru","exec(")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Detection Notes

  • Highest signal: any executable PHP-family file under /wp-content/uploads/elementor/forms/.
  • /wp-admin/admin-ajax.php is common on WordPress; elementor_pro_forms_send_form materially raises relevance.
  • Published attacker IPs are current high-volume sources but can rotate.
  • If WAF/reverse-proxy logs do not capture POST bodies, the action parameter may only appear in Message or application logs.
  • DeviceFileEvents and DeviceProcessEvents require endpoint coverage on the WordPress host.
  • Web-server child-process execution is high signal but should be validated against legitimate administrative tooling.

Leave a comment