# Security Brief: CVE-2026-32475 Elementor Pro Vulnerability Actively Exploited to Compromise WordPress Sites

Canonical: https://vulnify.app/blog/security-brief-cve-2026-32475-elementor-pro-file-upload-rce

CVE-2026-32475 is a critical Elementor Pro arbitrary file upload vulnerability affecting versions through 4.2.1. Attackers have actively exploited the flaw to upload executable PHP files to vulnerable WordPress sites, potentially leading to remote code execution and complete site compromise.

What happened CVE-2026-32475 is a critical arbitrary file upload vulnerability affecting Elementor Pro, the commercial version of the widely used Elementor page builder for WordPress. The vulnerability exists in the Elementor Pro Forms module and can allow an unauthenticated attacker to bypass file validation when submitting a form containing a File Upload field. Successful exploitation can result in an attacker-controlled PHP file being written to a web-accessible directory on the WordPress server. If that file is subsequently requested through the website, the PHP code may execute with the permissions of the web server process. This creates a direct route from an unauthenticated form submission to remote code execution and potentially complete control of the affected WordPress installation. The issue affects Elementor Pro versions through 4.2.1 and was corrected in version 4.2.2, released on August 19, 2026. Patchstack, which assigned CVE-2026-32475, classifies the vulnerability as CWE-434, Unrestricted Upload of File with Dangerous Type, and gives it a CVSS 3.1 score of 9.0, rated Critical. SecurityWeek reported a score of 9.8 when covering active exploitation. The authoritative CNA record currently carries the 9.0 score, while NVD has not assigned its own independent score and lists the record as deferred. The distinction does not materially change the response required from website owners. The vulnerability can be reached over the network, requires no authenticated WordPress account, requires no interaction from an administrator, and can result in executable code being placed on the server. The vulnerability is being actively exploited This is no longer only a theoretical vulnerability. SecurityWeek reported on September 5, 2026 that attackers were actively exploiting CVE-2026-32475 against WordPress websites. The report cites WordPress security company Defiant, the company behind Wordfence, which had observed and blocked more than 190,000 exploitation attempts. According to the reported telemetry, exploitation began immediately after the patched release became available on August 19. This is an important detail for administrators because simply updating Elementor Pro today does not establish that a previously vulnerable site was never compromised. Sites that were running Elementor Pro 4.2.1 or earlier while the vulnerable functionality was publicly reachable should consider both patching and retrospective compromise assessment. The attack volume also illustrates why popular WordPress plugins are attractive targets. Attackers can scan large numbers of websites looking for common plugin versions and exposed functionality rather than targeting one organization individually. A small business website, marketing site, ecommerce site, or local company can therefore receive the same automated exploitation attempts as a much larger organization. How CVE-2026-32475 works The flaw is located in the File Upload functionality used by Elementor Pro forms. Form submissions pass through validation logic before uploaded files are processed and moved into storage. The vulnerability results from the validation stage and the later processing stage handling empty file entries differently. When the validation loop encounters an upload entry indicating that no file was supplied, the vulnerable code returns from validation instead of skipping that empty entry and continuing to inspect the remaining files associated with the field. This can cause subsequent files to avoid the intended extension and file-type checks. The processing logic behaves differently. Rather than abandoning the entire field when it encounters the empty entry, it skips the empty item and continues processing the remaining uploaded files. This mismatch means a later file can be processed even though it was never subjected to the expected validation. Conceptually, the vulnerable workflow looks like this: Form submission | v File upload field contains multiple entries | v Validation encounters empty entry | v Validation stops early | v Later file is not validated | v Processing skips empty entry | v Unvalidated file is written to disk If the unvalidated file contains executable PHP and the web server allows PHP execution from the upload location, requesting that file can execute the attacker's code. From there, the attacker may be able to modify WordPress files, access configuration data, create additional persistence mechanisms, alter site content, or use the compromised server for further malicious activity. Which Elementor Pro sites are at risk The CVE affects Elementor Pro through version 4.2.1, but the vulnerable code path is associated specifically with the Forms module's File Upload functionality. Administrators should therefore identify not only the installed plugin version but also whether public Elementor forms contain file upload fields. Elementor is used across millions of WordPress installations, while Elementor Pro provides additional commercial features including the Form widget. SecurityWeek reported that Elementor Pro has more than six million active installations. Not every Elementor installation is therefore automatically vulnerable to this specific attack path, particularly sites using only the free Elementor plugin. Sites using Elementor Pro should nevertheless treat version identification as the first priority. A vulnerable plugin may remain installed on pages administrators have forgotten about, including old contact forms, recruitment forms, support forms, quotation requests, customer upload pages, or landing pages that are no longer linked from the main navigation but remain publicly reachable. Why it matters for website owners Arbitrary file upload vulnerabilities are among the more dangerous classes of WordPress plugin flaws because they can bypass the normal requirement for an attacker to obtain administrator credentials first. CVE-2026-32475 can potentially turn an ordinary public-facing form into an entry point for executing code on the server. Once remote code execution has been achieved, the original Elementor vulnerability may become only the first stage of the incident. An attacker with server-side PHP execution may attempt to create new administrator accounts, modify themes or plugins, insert redirects, steal WordPress database credentials, access customer information, inject malicious JavaScript, establish additional backdoors, or manipulate SEO content. This is why installing Elementor Pro 4.2.2 or later is necessary but may not be sufficient for a site that was exposed before patching. Updating closes the known vulnerable code path. It does not automatically remove a PHP file, administrator account, modified plugin, malicious scheduled task, or other persistence mechanism placed on the server during an earlier successful compromise. Indicators of compromise to investigate SecurityWeek reports that successful exploitation results in a PHP file being written beneath the Elementor forms upload location: /wp-content/uploads/elementor/forms/ Administrators should inspect this directory and its subdirectories for unexpected PHP files. The presence of an executable PHP file in this location is a strong indicator that the site requires further investigation. Legitimate form uploads such as documents or images should not normally require server-executable PHP content. Website and reverse-proxy logs should also be reviewed for unusual requests involving: /wp-admin/admin-ajax.php That endpoint is used legitimately by WordPress and many plugins, so its presence alone is not evidence of compromise. Administrators should look for unusual spikes, suspicious form submissions, requests associated with Elementor form processing, and subsequent requests for unfamiliar files beneath the Elementor forms upload directory. If evidence of an unauthorized PHP upload is found, the investigation should extend beyond deleting that individual file. A successfully executed web shell may have been used to establish persistence elsewhere on the site. What to check on your site Check the Elementor Pro version. Any installation running version 4.2.1 or earlier falls within the published affected range. Update to 4.2.2 or later. Confirm you are checking Elementor Pro. CVE-2026-32475 concerns the commercial Elementor Pro plugin and its Forms functionality, not simply the presence of the free Elementor page builder. Inventory Elementor forms. Identify publicly accessible forms containing File Upload fields, including forms on old landing pages or pages not linked from the primary navigation. Inspect the Elementor form upload directory. Review /wp-content/uploads/elementor/forms/ for PHP files or other unexpected executable content. Review access logs. Investigate suspicious requests to /wp-admin/admin-ajax.php and requests for unfamiliar PHP files beneath Elementor upload directories. Check WordPress administrator accounts. Look for recently created or unfamiliar privileged users. Review plugins and themes. Identify unexpected installations, modified files, disabled security plugins, or recently changed theme components. Check persistent WordPress code. Review must-use plugins, WordPress configuration files, scheduled tasks, and other locations commonly used to maintain access after compromise. Compare files against known-good copies. If compromise is suspected, verify WordPress core, plugins, and themes against trusted packages rather than assuming that visible site functionality means files are clean. Review credentials. If server-side code execution is confirmed, consider WordPress administrator passwords, database credentials, hosting credentials, API keys, and other secrets accessible to the application potentially exposed. Recommended response The first action is to update Elementor Pro to version 4.2.2 or later. Patchstack confirmed that 4.2.2 contains the corrected implementation and lists it as the minimum safe version for CVE-2026-32475. If an immediate update is impossible, administrators should consider disabling Elementor Pro forms containing file upload functionality, or disabling the affected plugin until it can be updated. A temporary mitigation should not replace installing the vendor's corrected release. Sites that remained on a vulnerable version after August 19 deserve additional scrutiny because active exploitation was observed from the date the fix became public. Administrators should preserve relevant logs before making major changes if an incident investigation may be required. Where compromise is confirmed, response should be broader than deleting the initially uploaded file. Restore compromised application files from trusted sources, remove unauthorized accounts and persistence mechanisms, rotate exposed credentials, examine the hosting environment, and determine whether sensitive information was accessed. Reducing file upload risk File uploads should always be treated as untrusted input. WordPress plugins that accept documents, images, attachments, resumes, receipts, support files, or other uploads need multiple layers of protection rather than relying on one filename or extension check. Where technically practical, servers should prevent script execution from directories intended only for user-generated uploads. Even if a malicious PHP file reaches storage because of an application vulnerability, preventing PHP execution within upload directories can provide an additional barrier between file upload and remote code execution. Allowlisting expected file formats, validating actual content rather than filenames alone, generating server-controlled filenames, limiting file size, maintaining restrictive filesystem permissions, and storing sensitive uploads outside the public web root can further reduce risk. These are defence-in-depth measures and do not remove the need to patch CVE-2026-32475. Using Vulnify for WordPress review Website owners can use the Stack Checker to review publicly detectable WordPress components and gain greater visibility into the technology exposed by a site. This can help identify WordPress properties requiring closer plugin inventory and version review. Vulnify should be used as part of the assessment process rather than as proof that a previously vulnerable Elementor Pro installation was never compromised. A public-surface assessment cannot reliably determine whether an attacker previously executed PHP, added a hidden administrator, modified server-side files, or installed persistence outside publicly detectable paths. For broader remediation guidance, the Security Hardening Checklist covers practical measures for reducing WordPress exposure, managing plugins, protecting administrative access, and reviewing common configuration weaknesses. Organizations handling customer or personal information may also find Article 32 for Web Teams: Technical Measures Explained useful when considering the technical controls expected around systems processing personal data. Related reading Security Hardening Checklist Article 32 for Web Teams: Technical Measures Explained Conclusion CVE-2026-32475 is particularly important because the vulnerable functionality sits behind public Elementor Pro forms and can be exploited without first authenticating to WordPress. A validation error in handling multiple uploaded file entries can allow dangerous files to bypass the normal checks, after which executable PHP may be written into a publicly reachable upload directory. Elementor Pro 4.2.2 fixes the vulnerability, but active exploitation means administrators should not stop at checking the current version. Websites that were running 4.2.1 or earlier after disclosure on August 19, 2026 should review the Elementor forms upload directory, server logs, administrator accounts, plugins, themes, and other possible persistence locations. The more than 190,000 exploit attempts reported as blocked by Wordfence demonstrate how quickly serious WordPress vulnerabilities can attract automated exploitation. Updating vulnerable plugins quickly, maintaining an accurate component inventory, restricting executable content in upload locations, and checking for signs of compromise after critical vulnerabilities become public are essential parts of operating WordPress safely. Sources : Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites : Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin