Elementor Pro CVE-2026-32475 file upload exploit attempt

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•4

Detects incoming HTTP POST requests targeting the 'admin-ajax.php' endpoint with parameters associated with a malicious file upload exploit against Elementor Pro (CVE-2026-32475). The rule specifically looks for the 'elementor_pro_forms_send_form' action and the presence of PHP file extensions within form fields, indicating an attempt to upload a web shell.