Security firm Wordfence has reported that exploitation attempts for the Elementor Pro vulnerability began on August 19, the same day the vendor released version 4.2.2 to address the issue. Between August 19 and 23, Wordfence blocked more than 190,000 exploitation attempts targeting its clients.

The vulnerability stems from faulty validation of file-upload arrays in Elementor Pro forms. According to Wordfence, attackers submit the form's File Upload field as an array, where the first element is empty and the second element carries a PHP payload with a .php filename. This structure triggers a validation bypass, allowing arbitrary PHP files to be uploaded to the server.

Once uploaded, the payload is stored in the /wp-content/uploads/elementor/forms/ directory under a randomly generated filename with the supplied .php extension. The attacker can then request the file directly to execute arbitrary commands remotely. Exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, a common configuration.

Patchstack, another WordPress cybersecurity platform, had warned about the vulnerability in August, noting that it could be exploited to upload arbitrary PHP files and trigger code execution.

Administrators are urged to upgrade to Elementor Pro 4.2.2 or later immediately and inspect the /wp-content/uploads/elementor/forms/ directory for any rogue PHP files. Since this location is used to store uploaded form submissions, the presence of a PHP file is a strong indicator of compromise that should trigger clean-up operations. Wordfence has also provided a list of IP addresses linked to thousands of attacks for defenders to block.