Loading today’s stories
Security1 distinct publisher2 min readPublished
Wordfence has blocked nearly 200,000 attempts against CVE-2026-32475 since August 19. Because the payload is a PHP file already sitting in the uploads tree, upgrading to 4.2.2 tells you nothing about whether you were hit.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The bypass needs no account. Wordfence's description of the request is the whole exploit: the File Upload field is submitted as an array, the first element is empty, the second carries a PHP payload with a .php filename, and the plugin stops validating after the empty entry [5]. The file lands in /wp-content/uploads/elementor/forms/ under a randomly generated name that keeps the attacker-supplied extension, and the attacker then requests it directly to run commands [10]. The only prerequisite is a published Elementor Pro Form widget with at least one File Upload field, which the reporting describes as a common configuration [9].
The volume says what kind of activity this is. Wordfence counted more than 190,000 blocked attempts between August 19 and 23, and close to 200,000 since the patch shipped [7][6]. That puts roughly 95 percent of the total inside a five-day window [1], averaging about 38,000 a day [2], with the remaining 10,000 or so spread across everything after August 23 [3]. That profile matches opportunistic scanning against a fixed path.
Two caveats on the 200,000. It is Defiant's own client telemetry, not the more than 6 million active installations attributed to the plugin [6][1]. And blocked attempts are requests, not victims: a single target can absorb thousands, and any site without a WAF in front of it contributes nothing to the count at all.
Patchstack flagged the arbitrary PHP upload and code execution path last month [8]. Wordfence supplied the exploitation timeline, placing first activity on August 19, the same day Elementor released 4.2.2 [13][2]. The interval between fix availability and attack traffic was therefore zero days [4]. For anyone running a staged or monthly update cadence on client sites, the patch was never ahead of the scanning.
Upgrading closes the write path but leaves on disk anything written before the upgrade, and the indicator here is unusually clean. That directory exists to store form submissions, so a PHP file in it is a strong indicator of compromise and a trigger for clean-up rather than a finding to weigh [11]. Versions 4.2.1 and earlier are affected [3], the outcome is a webshell and arbitrary command execution [4], and the IP list Wordfence published is worth loading for edge noise reduction [12] while saying nothing about what was already written.
The set that needs a file-level check is narrower than the install base: sites that had a published upload form live on August 19 [9][2]. Most agencies can produce that list from their own build records faster than they can run a scanner across every tenant.
Ranked by verification strength, evidence, and original report placement.
Elementor Pro is a WordPress page-builder plugin with more than 6 million active installations.
CVE-2026-32475, a critical vulnerability in Elementor Pro, was patched on August 19 in version 4.2.2.
The flaw stems from faulty validation of file-upload arrays in Elementor Pro forms and is present in versions 4.2.1 and earlier.
CVE-2026-32475 is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server.
Wordfence: "The attacker submits the form's File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php filename, which is the structure that triggers the validation bypass."
Since the August 19 patch, Defiant's Wordfence web application firewall has blocked almost 200,000 exploitation attempts targeting its clients.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 3, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Two loops, one blocklist bypass: Elementor Pro's upload field becomes unauthenticated RCE4 distinct publishers
security
Six bugs, one order of operations: Avada's zero-click chain is a same-day patch1 distinct publisher
security
Two miniOrange SAML bugs under attack, and 30,000 paid installs were never told5 distinct publishers
security
GiveWP issues accounts to unauthenticated attackers on sites where registration is off3 distinct publishers
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Mechanism nailed down, impact unwitnessed
The technical spine is strong: Wordfence is quoted describing the array structure that defeats validation and the exact directory the malicious PHP file lands in, and Patchstack had flagged the same code-execution risk a month earlier. What no one supplies is a single confirmed compromised site. Blocked attempts are the only outcome measured, by the firm whose product does the blocking, on the subset of sites it protects.
Attacks counted, patched sites not
What is genuinely measured is attacker uptake: nearly 200,000 blocked attempts, front-loaded into five days, plus an IP list heavy enough to be worth publishing. What is missing is the defender side of the same arithmetic - of six million active installations, how many still run 4.2.1 or earlier, and how many of those publish a form with a file-upload field. BleepingComputer calls that configuration common and leaves it there.
Blocked attempts reading as break-ins
"Exploited to take over WordPress sites" is doing more work than the numbers underneath it. Every one of those 200,000 attempts is, by definition, an attack that failed against a protected site; the takeovers are inferred, not counted. Some credit runs the other way - the guidance is honest that a PHP file in the uploads tree means clean-up, not just patching, which is the part most coverage of a plugin CVE would skip.
The counter sells the countermeasure
The attack volume, the exploit write-up, and the blocklist all come from Defiant's Wordfence, a firewall vendor whose case for existing is precisely that 190,000 attempts hit its customers and stopped there. Patchstack, the corroborating voice, sells WordPress security too. And the piece signs off with a pitch for a simulation-based defence report that has nothing to do with Elementor. None of that makes the telemetry wrong; it does mean no disinterested party has counted anything in this story.
Trust the fix, verify the fallout
Act on the actionable half without hesitation - the affected range, the fixed version, the precondition and the directory to inspect are specific and internally consistent, and the exploitation-on-release-day timeline comes straight from the advisory. Hold the impact half loosely: one publisher, one vendor's client base, zero corroborated victims, and no independent view of how many vulnerable sites remain.