Elementor Pro flaw exploited in WordPress attacks

Attackers are exploiting CVE-2026-32475, a critical Elementor Pro plugin vulnerability patched in version 4.2.2, to upload PHP webshells and execute arbitrary commands. Wordfence has blocked over 190,000 exploitation attempts since August 19. Sites with published Form widgets containing File Upload fields are vulnerable.