Last week we wrote about a critical upload flaw in Forminator Forms. Now another WordPress form builder has landed in the same ugly neighbourhood.
This time it is Elementor Pro.
CVE-2026-32475 lets an unauthenticated attacker bypass the file checks in Elementor Pro forms, upload a PHP file into a public directory, and run it on the server. No WordPress account. No stolen password. No administrator clicking a link.
Elementor fixed the flaw in Pro version 4.2.2 on August 19. Every version up to and including 4.2.1 is affected. If Elementor Pro is active on your site, check the version before doing anything else.
This affects Elementor Pro, not every Elementor site
Let’s clear up the first misleading number. The free Elementor plugin runs on more than 10 million sites, but this vulnerability sits in the Forms module supplied by Elementor Pro. A site using only the free plugin does not have that Pro form code.
The risky setup needs a published Elementor Pro Form widget with a File Upload field. Think job applications, support tickets, quote requests with drawings, or a contact form asking for a screenshot. Normal business forms. Nothing exotic.
The free-versus-Pro distinction matters, but it should not become an excuse to guess. Open the Plugins screen. If Elementor Pro is there and the version is 4.2.1 or older, update it.
A vulnerability scanner should flag the old plugin version. It will not tell you whether a published form contains a File Upload field, so that still needs a quick manual check.
One upload, two sets of rules
The bug is surprisingly ordinary. Elementor Pro checks an uploaded file in one loop, then moves accepted files in a second loop. Those two pieces of code disagree about what to do with an empty file entry.
A carefully shaped form submission makes the validation loop stop early. The later file never gets its extension checked. The processing loop behaves differently: it skips the empty entry, carries on, and moves the next file into wp-content/uploads/elementor/forms/.
That directory is public. If the unchecked file is PHP, requesting its address makes the server execute it. At that point the attacker is no longer “using a form.” They are running code with the permissions of the web server.
The full technical analysis comes from Patchstack’s original disclosure. The important bit for a site owner is simpler: version 4.2.2 makes validation and file processing agree, then checks the extension again immediately before moving the file.
Elementor and Patchstack describe the affected setup differently
This part deserves a straight answer rather than pretending the reports match perfectly.
Patchstack says the prerequisite is one published Elementor Pro form containing a File Upload field with its Required toggle off – the default setting. Elementor’s customer notice described a different, narrower setup: the form must have multiple-file upload enabled, which is disabled by default.
Could the narrower vendor description be right for the exact exploit they tested? Possibly. Does that make it sensible to leave 4.2.1 online because your toggle looks different? Nope.
The vulnerable code is present either way, the patched release is available, and updating is cheaper than proving which interpretation applies to every form on the site. Treat any public Elementor Pro file-upload form on 4.2.1 or older as exposed until it is updated and checked.
No confirmed attacks yet – use the gap
As of August 24, there are no confirmed reports of CVE-2026-32475 being exploited in the wild. That is good news, not permission to park the update until next month.
The patch and the technical explanation are now public. Anyone capable of comparing the old and new code has a map. We have already seen how quickly WordPress flaws move from disclosure to automated scanning; waiting for the first confirmed victims usually means waiting too long.
This is exactly why routine WordPress maintenance matters. Premium plugins are particularly easy to miss when a licence expires or an update stops appearing in the dashboard. If Elementor Pro will not update automatically, download the current package from the account that owns the licence and install it manually. Do not leave a vulnerable copy active because the renewal email went to an old employee.
What to do today
- Update Elementor Pro to 4.2.2 or newer. Updating the free Elementor plugin alone does not patch the Pro code.
- Find every published form with a File Upload field. Check pages, popups, landing pages, and templates.
- Inspect
wp-content/uploads/elementor/forms/. Look for.php,.phtml, or files your forms were never meant to accept. - Review recent changes. Check administrator accounts, newly installed plugins, scheduled tasks, and unusual outbound connections.
- Keep evidence if something looks wrong. Take a snapshot before deleting files.
Updating closes the upload route. It does not remove a webshell that arrived while the old version was active. File integrity monitoring can help identify unexpected additions, provided the Elementor forms directory is included in the monitored paths.
Also check whether those upload fields are still needed. A job vacancy that closed six months ago does not need to keep accepting files from the entire internet. Remove dead forms. Fewer public upload points means fewer things to watch.
If you find PHP in the forms directory
Don’t just delete it and carry on. Save a snapshot, note the filename and modification time, then inspect access logs around that moment. Look for other changed files, hidden administrator accounts, unfamiliar plugins, and persistence in mu-plugins or scheduled tasks.
Our guide on what to do when you suspect a compromise covers the first response without wiping useful evidence. Once unknown PHP has executed, the job has moved beyond an Elementor update. It needs a proper hacked WordPress cleanup.
A webshell is an entry point. The attacker can place the lasting backdoor somewhere completely unrelated to Elementor, which is why deleting one obvious file is not enough.
The short version
Elementor Pro 4.2.1 and older contains a critical unauthenticated file-upload flaw. A vulnerable public form can let an attacker place PHP in a web-accessible directory and execute it. Elementor Pro 4.2.2 fixes the problem.
Update the Pro plugin. Inspect wp-content/uploads/elementor/forms/. Check every public upload form. And do it while there are still no confirmed attacks to clean up after.