WordPress Plugins Exploited in Aug–Oct 2026 (Elementor Pro, etc.)

I was reading through WordPress plugin vulnerability databases for the past three months (5 Aug. to 5 Nov. 2026), so I collected the findings in one place because most news reports cover one plugin at a time and often disagree on the numbers. I included only those whose dates and versions I could confirm from primary sources, and I state clearly which primary sources I could read in full and which required relying on news reports citing another source.

I found none of these in CISA KEV based on the fields in NVD, with data current as of 5 Nov. 2026.

Elementor Pro CVE-2026-32475

Patchstack assigned this CVE, reported by researcher Tin Pham (TF1T) on 16 July. Plugin version 4.2.2 was released alongside the advisory on 19 Aug. 2026. According to Patchstack's description, the Forms module has a file upload field whose extension checks and file moves run in two loops that handle "empty files" differently. If the first part is empty and followed by a .php file, the validation loop stops early, but the move loop still moves the second file into a public folder.

• No login required
• Condition: a published page has a Form widget with a file upload field, which is not set to Required by default
• Planted files are stored in wp-content/uploads/elementor/forms/ with random uniqid() names consisting of 13 hexadecimal characters

The scores differ. NVD (from Patchstack) gives CVSS 3.1 = 9.0, while news reports citing Wordfence give 9.8. I could not open Wordfence's original page, so I cannot confirm the 9.8 score.

Actual exploitation. The Patchstack article I could read describes only the vulnerability and does not mention attacks. BleepingComputer's report on 3 Sept. 2026 cites Wordfence as seeing attacks since 19 Aug., the same day the patch was released, and blocking roughly 190,000 to 200,000 attempts since 19 Aug. (different news outlets use different cutoff dates). I therefore treat these figures as "reports whose original source I have not seen," rather than data I have independently confirmed. Still, all sources point in the same direction: heavy exploitation from day one.

WooCommerce Wholesale Lead Capture CVE-2026-27540

Patchstack assigned this plugin's CVE and dated the advisory 20 Feb. 2026, with 2.0.3.2 as the fixed version. The researcher is Teemu Saarentaus. NVD published it on 19 Mar. 2026 with CVSS 3.1 = 9.0. The Patchstack page says "known to be exploited" and that no login is required. The patch has been available for a long time, but this falls within the period I am looking at because attacks are continuing.

News reports from mid-Sept. 2026 (Infosecurity Magazine and BleepingComputer) cite a Wordfence write-up dated 14 Sept. saying it had blocked more than 100,000 attack attempts. I did not open Wordfence's original write-up myself and have not confirmed when the attacks peaked. The mechanism reported in the news is that the AJAX action wwlc_file_upload_handler takes its extension allowlist from the attacker-controlled file_settings parameter. Adding php allows scripts to be uploaded. This is a premium plugin, and updates are available only through a licence from the vendor.

Two other high-scoring vulnerabilities with no reported exploitation

Ultra Addons for Contact Form 7 CVE-2026-84750 has an upload field that does not check file types and stores files at a predictable public path. NVD published it on 19 Sept. 2026. The result is RCE on Apache on Debian/Ubuntu where .phar is mapped to PHP, and stored XSS elsewhere. The fixed version is 3.5.51. The scores differ: NVD gives 6.5, while the Wordfence search result I saw gives 9.8. I could not open the Wordfence page. NVD records the CISA coordinator's exploitation status as none. (Note: Wordfence lists a separate PHP Object Injection vulnerability that also affects versions through 3.5.51. The Wordfence page needs to be checked for its fixed version; I have not confirmed it yet.)

Piotnet Addons For Elementor Pro CVE-2026-28192 allows file uploads without logging in, affecting 7.1.67 and earlier. NVD published it on 18 Aug. 2026 with a score of 9.6, and I still cannot confirm a fixed version from NVD. If you use this plugin, check Patchstack's advisory page or remove it until a fixed version is available.

I left out Burst Statistics (CVE-2026-8181) and ARVE (CVE-2026-18072), which appeared in news reports during that period, because NVD published them before the period covered here (14 May and 29 July 2026). I also could not find a primary source for CVE-2026-102435 in Ultra Addons, which some people mentioned.

Check plugin versions across multiple sites with wp-cli

Prepare a sites.txt file containing each site's path, one site per line, then run as the site's user.

while read -r p; do
  echo "== $p"
  sudo -u webuser wp --path="$p" --skip-plugins --skip-themes core version
  sudo -u webuser wp --path="$p" --skip-plugins --skip-themes plugin list \
    --fields=name,version,status --format=csv \
    | grep -E 'elementor-pro|woocommerce-wholesale-lead-capture|ultimate-addons-for-contact-form-7|piotnet-addons-for-elementor-pro'
done < sites.txt

Licensed plugins can be updated through wp-cli while the licence is still active. If the command cannot update them, do it through the Dashboard.

sudo -u webuser wp --path=/var/www/example.com plugin update elementor-pro
sudo -u webuser wp --path=/var/www/example.com plugin update ultimate-addons-for-contact-form-7

Check whether a site has been compromised

Always inspect the site after updating, because files planted earlier do not disappear on their own.

# Elementor Pro: IOC จาก Patchstack คือไฟล์ php ในโฟลเดอร์นี้
find /var/www/example.com/wp-content/uploads/elementor/forms -type f \
  \( -iname '*.php' -o -iname '*.phar' -o -iname '*.phtml' \)

# ทุกปลั๊กอิน: ไฟล์สคริปต์ในโฟลเดอร์อัปโหลดทั้งหมด
find /var/www/example.com/wp-content/uploads -type f \
  \( -iname '*.php' -o -iname '*.phar' -o -iname '*.phtml' \)

# แอดมินที่ไม่ได้สร้างเอง
sudo -u webuser wp --path=/var/www/example.com user list --role=administrator

For Lead Capture, checking logs directly may turn up nothing because action=wwlc_file_upload_handler is normally in the POST body, not the URL. If you use ModSecurity and retain audit logs of POST requests, search for this action name in those logs. Ordinary access logs can show only whether there is an unusually high rate of POST requests to /wp-admin/admin-ajax.php. According to the reports, attackers leave behind a web shell that displays system information and has a form for uploading more files.

If you find a suspicious file, do not just delete it and stop there. Treat that site as at risk and follow these steps.

1. Preserve evidence Copy files and logs elsewhere before deleting them
2. Change passwords Change site admin and database passwords, then update the salt values in wp-config.php
3. Check cron and new users Look for anything attackers left behind to regain access
4. Restore from a clean backup If you cannot confirm that all traces have been removed

For guidance on inspecting the server, see Debian server security scan.

Another layer is to block script execution in uploads folders, configured for the web server you use.

# wp-content/uploads/.htaccess (Apache 2.4)
<FilesMatch "\.(php|phar|phtml)$">
  Require all denied
</FilesMatch>

location ~* ^/wp-content/uploads/.*\.(php|phar|phtml)$ {
    return 403;
}

This measure is only an extra layer. It will not work if a new .htaccess overrides it or the site's configuration does not read .htaccess.

My approach

Personally, I would prioritise them like this: handle Elementor Pro and Lead Capture first, within the day, because exploitation has been reported and attacks require no login. Handle Ultra Addons and Piotnet in the next available round of updates, as soon as possible. For any site using Piotnet without a fixed version available, I would remove it for now rather than take the risk. But if the form is truly necessary, disable its file upload field for now.

P.S. I read the Wordfence blocking figures in this post through news reports, not the original posts. If you need to cite them formally, open Wordfence's original sources and cross-check them.

Sources: Patchstack (https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/), Patchstack WooCommerce Wholesale Lead Capture (https://patchstack.com/database/wordpress/plugin/woocommerce-wholesale-lead-capture/vulnerability/wordpress-woocommerce-wholesale-lead-capture-plugin-1-17-8-arbitrary-file-upload-vulnerability), NVD CVE-2026-32475, CVE-2026-27540, CVE-2026-84750, CVE-2026-28192, CVE-2026-8181, CVE-2026-18072 (https://nvd.nist.gov/), Wordfence Intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/) Data current as of 5 Nov. 2026. Attack figures come from news reports citing Wordfence. If any of these get a fixed version or further reports, I will come back and update this later.