Elementor released Elementor Pro 4.2.2 on 19 August 2026, fixing a vulnerability in the Form widget’s File Upload field that allows an unauthenticated visitor to upload a PHP file to the site and run it. Patchstack rates it 9.0 out of 10.
The Vulnerability
CVE-2026-32475 is rated Critical with a CVSS score of 9.0 out of 10. It affects every Elementor Pro version up to and including 4.2.1 — a plugin with an estimated 6 million active installations, according to Wordfence.
The upload field checks file extensions in one loop and moves the files to disk in a second loop, and the two handle an empty file entry differently. The validation loop stops when it meets an empty entry; the processing loop skips past it and carries on. By sending an empty file part followed by a .php file, an attacker gets the second file written into a public directory without the extension check ever running on it.
No login, cookie, or nonce is needed. The only requirement is a published page with an Elementor Pro Form widget that contains a File Upload field — a contact form with an “attach your CV” or “upload a photo” field is enough.
Elementor’s customer notification on 19 August says the issue only affects forms with the multiple-file upload option enabled, which is off by default. Patchstack’s write-up, from the programme that handled the report, says no special configuration is needed, and Wordfence’s advisory likewise requires only a published form with at least one non-required File Upload field. We are treating any site with an upload field as exposed until it is patched.
The flaw was reported to Elementor on 16 July 2026 by researcher Tin Pham through the Patchstack bug bounty programme; a second researcher, Austin Ginder, reported it independently to Wordfence on 24 July. Elementor had a patch ready on 17 July; Patchstack confirmed the fix on 3 August, and the public release followed on 19 August.
What It Means for Sites We Manage
Elementor Pro is one of the most common paid plugins on the sites we look after.
Every site on a WP Care plan runs Patchstack, which has a mitigation rule for CVE-2026-32475 in place. That blocks the attack pattern at the request level regardless of plugin version, so the gap between disclosure and update was covered. We are updating Elementor Pro to 4.2.2 across all affected sites in this week’s update run, with sites that have a File Upload field going first.
[Andrew: adjust to reflect what has actually been done by publish time.]
What Our Clients Need to Do
Nothing. The update is handled on our side, and Patchstack has been blocking the attack in the meantime.
Self-Managed Sites
Check Plugins → Installed Plugins and confirm Elementor Pro is on 4.2.2 or later. If it is not, update now — Patchstack expects this to be used in mass-exploitation campaigns, as previous critical Elementor Pro flaws have been.
If your site has been running an older version with a public upload form, updating closes the door but does not remove anything that came through it. Look in wp-content/uploads/elementor/forms/ for .php files, and check for unfamiliar administrator accounts under Users. If you find either, the site needs a proper clean-up, not just the update.
For a once-over on whether your site is patched and whether anything got in beforehand, get in touch or see our managed WordPress care plans.
Sources
- Patchstack article
- Patchstack DB entry
- Wordfence advisory
- Wordfence entry
- The Hacker News
- Elementor customer email 19 Aug 2026
