A Elementor Pro vulnerability has been disclosed that, if abused, can result in remote code execution on WordPress sites. Researchers link the issue to CVE-2026-32475 and indicate that especially sites using certain contact or request forms are at risk. The vulnerability affects versions before and including 4.2.1; a patch is now available in Elementor Pro 4.2.2.
What makes this incident especially serious is that the attack can be carried out by a party without authentication, provided the website uses a specific configuration in Elementor’s Forms module.
What makes the Elementor Pro vulnerability dangerous?
The core of the problem lies in the Forms module of Elementor Pro, specifically the File Upload field. According to Patchstack, checks related to file extensions and the processing of uploaded files are not performed consistently. As a result, an attacker may still get a normally blocked file type written to a public directory.
The analysis describes that extension validation and the “moving” of the uploaded file happen in two separate steps/loops, with different handling for empty file input. By submitting two file components to the same upload field, an attacker can bypass the extension blocklist and place a PHP file into a public directory.
How does the attack work in practice?
Researchers state that only one condition is needed to try a successful attack: the affected site must contain at least one published Elementor page with a Form widget that includes a File Upload field. For example, common forms such as job application forms, forms that let visitors upload a photo/ID/receipt, or support requests with attachments.
The upload process writes a file to:
- wp-content/uploads/elementor/forms/<uniqid>.php
where <uniqid> is the output of PHP’s uniqid(). After that, the planted PHP script can be used to run code on the server.
In addition, the findings emphasize that the “Required” setting for the upload field is turned off by default. That means you don’t need unusual or exotic settings to fall into the risk group. Sites with open sign-up or broadly accessible roles can therefore be exposed more quickly.
Which versions are vulnerable, and what is the patch?
The Elementor Pro vulnerability (CVE-2026-32475) affects all versions before and including 4.2.1. The fix was released in Elementor Pro 4.2.2, which became available after reporting through the Patchstack Bug Bounty Program on August 19, 2026.
Timing is also relevant: the publication comes shortly after a WordPress release for another high-risk issue (CVE-2026-65640) that is also about remote code execution via a malicious file upload by users with higher privileges. Even though that involves a different mechanism, the theme is consistent: file uploads remain a top attack route in web application vulnerabilities.
Why is unauthorized upload possible?
Patchstack explains that the bug lies in the difference between how Elementor checks the file extension and how the file is subsequently written, especially when there is empty file input in the upload field. By manipulating two file parts for the same field, an attacker can:
- bypass the extension blocklist
- write a .php file to a public directory
- then use the uploaded code for remote code execution
In other words, the upload field meant to act as a “limited” upload mechanism is, due to the inconsistency in processing, turned into something that can be used to inject code.
Risk indicators for your WordPress site
Not every site running Elementor Pro is immediately a victim, but you can fairly easily determine whether you are in the danger zone. Watch for these points:
- Do you use Elementor Forms? Check whether a Form widget is present on a published page.
- Do those forms have a File Upload field? Especially when uploading attachments is part of the process.
- Is “Required” off by default? According to the description, that’s a normal situation—meaning you may not need “hard” settings to be affected.
- Are there unknown accounts or extra plugins added? Unexpected additions can indicate an earlier compromise.
If you also notice suspicious redirects or pop-ups, treat that as additional evidence to investigate more deeply.
What should you do now? (practical approach)
Patchstack advises users to get security in order quickly. You can use this as a checklist:
- Update Elementor Pro to 4.2.2 or newer.
- Check for unauthorized changes in files (for example, new or modified PHP files in upload directories).
- Scan for unexpected redirects or pop-ups that may indicate malware.
- Audit users and roles: look for unknown accounts.
- Review plugins for additions you didn’t install yourself.
By combining these steps, you not only reduce the chance of a successful attack, but also the chance that an attacker is already present.
The bigger picture: why this fits other WordPress risks
This Elementor Pro vulnerability follows a recurring pattern: attacks take advantage of the combination of web functionality (such as forms and upload fields) and weak or inconsistent validation. That’s why it’s useful to broaden your understanding of related incidents.
If you want to see how attackers can go further through “entry channels” such as upload and integration functions, this may also be relevant to read alongside this case: GitHub Actions flaw at Snowflake: command injection explained. Even though it concerns a different environment, the underlying lesson—untrusted input and validation that isn’t airtight—shows up in many modern attacks.
It’s also smart to consider the consequences once a WordPress site has been compromised. There’s an ongoing trend in which thousands of compromised websites are used as infrastructure. About that mechanism, you can read more here: StopAndProtect: 2,000 hacked WordPress sites.
Conclusion
The disclosed Elementor Pro vulnerability (CVE-2026-32475) shows how an apparently “normal” upload field inside Elementor Forms can go off the rails. Due to differences in file validation and processing, an attacker without authentication can write a PHP file to a public directory and thereby enable remote code execution.
The key action is clear: update to Elementor Pro 4.2.2, then check your site for suspicious files, accounts, and plugins. This not only prevents abuse of this specific flaw, but also directly improves your overall resilience against similar attacks.
Source: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
