Elementor Pro Bug Exploited: 200,000 Webshell Attacks Target WordPress Forms

A patched upload bug in Elementor Pro is now a live webshell delivery path, and the clock started the day the fix shipped

CVE-2026-32475, a critical validation flaw in the Elementor Pro plugin for WordPress, is being exploited in the wild to drop webshells on business websites. The bug let attackers upload a PHP file through a standard contact form and run arbitrary commands on the server. Elementor shipped the fix on August 19 in version 4.2.2. Wordfence has since blocked close to 200,000 exploitation attempts across its customer base, with the heaviest burst between August 19 and 23.

If that number feels abstract, consider what Elementor Pro is: a drag-and-drop page builder with more than six million active installations. In South Africa, Nigeria, and Kenya, it sits under a large share of agency-built business sites, WooCommerce storefronts, and brochure-ware for companies that never think about their CMS. A weaponised upload bug in this plugin is a shotgun blast at Africa’s small-business web.

How the attack works

The defect is in how Elementor Pro forms (versions 4.2.1 and earlier) validate file-upload arrays. The plugin checks the first file in the array and, under the right conditions, stops checking the rest. Attackers abuse that with a two-part submission:

• First array element: an empty file. Validation passes, attention moves on.
• Second array element: a PHP payload with a .php filename. It never gets validated.
• The landing zone: the payload is written to /wp-content/uploads/elementor/forms/ under a random filename, keeping its .php extension.

The attacker then requests that URL directly and executes commands on the server. No credentials needed, no login required, just an HTTP POST to a form half the internet runs. The precondition is a published Elementor Pro Form widget with at least one File Upload field, which is a common configuration for anything from job applications to quote requests.

The patch-day problem

Here’s the detail I keep coming back to. Wordfence dates the start of exploitation to August 19, the same day Elementor released 4.2.2. Public patches are attack instructions. A fix diff shows exactly which code path was vulnerable, and the window between “patched” and “every site updated” is when mass exploitation happens. For site owners who treat plugin updates as a monthly chore, this bug turned their deferral into a compromise.

Patchstack had warned the month before that the flaw allowed arbitrary PHP uploads and code execution. The difference between that warning and this advisory is weaponisation: someone built the exploit, and it’s now running against whoever is still exposed.

What African businesses should do now

1. Update Elementor Pro to 4.2.2 or later. If your site is agency-managed, that’s a call or an email today, not at the next review.
2. Inspect /wp-content/uploads/elementor/forms/. That directory holds form submissions. Any .php file sitting in there is a strong indicator of compromise. Remove it, then find out how it landed.
3. Assume a webshell means full review. Check for new admin users, scheduled tasks, and modified core files. Many of these sites live on shared hosting, so a clean-up without a root-cause review risks reinfection.

Where network-layer controls fit

Patching closes the door. It doesn’t do anything about what a webshell does next: talking outbound, pulling database credentials, or acting as a foothold toward the rest of the internal network. That’s the part most WordPress security advice skips. Once an attacker holds server-side code execution, application-layer defenses are already behind them, and what matters is whether the compromised box can reach anything else without being seen and stopped.

This is the gap eHawu is built for. Encrypted, obfuscated tunnels (AES-256-GCM, zero-knowledge architecture, no logs) mean traffic between your sites, staff, and infrastructure doesn’t traverse the network in a form a hijacked webshell can ride. An Android VpnService-based client locks down the workforce side, so a breach on a marketing CMS doesn’t become a straight line to the finance stack.

The question for any business running Elementor this week isn’t whether the patch exists. It does. It’s whether anyone checked their uploads folder. With eHawu, the compromised-perimeter scenario at least hits a wall before it becomes a breach.