Security Brief: Elementor Pro Unauthenticated File Upload
https://vulnify.app/blog/security-brief-elementor-pro-unauthenticated-php-upload-2026-08

CVE-2026-32475 in Elementor Pro through 4.2.1 can let a visitor upload PHP via a public form. Update to 4.2.2, inspect the forms upload folder, and review admins.

The Hacker News covered a critical bug in Elementor Pro: a visitor who never signs in can place a PHP file on the server and run it. The vendor shipped a patched build. If you use Elementor Pro, update it this week and inspect the forms upload folder, even if you already clicked Update last month. What happened Public records track this as CVE-2026-32475. Patchstack, the CVE Numbering Authority for this record, scored it CVSS 9.0 (Critical). Elementor Pro through version 4.2.1 is in scope. Version 4.2.2, released 19 August 2026, is the first build that closes the gap. The Hacker News piece is recap coverage of that same flaw, not a second unrelated bug. The issue sits in the Forms widget's File Upload field. Elementor Pro checks an uploaded file's type in one step and moves the file onto disk in another. Those two steps did not treat empty uploads the same way. The result: a file type the plugin meant to block could still land in a public folder. That folder is wp-content/uploads/elementor/forms/ . If PHP runs there, requesting the file can execute code as the web server, which is enough to take over WordPress. You do not need a stolen password. The form is public by design on contact, careers, and support pages. Having Elementor Pro installed is not, by itself, the whole risk. A published page with a Form widget that includes a File Upload field is the door. Confirm whether that field exists on any live page, including landing pages you forgot about. Patchstack reported the bug to Elementor in July 2026 and later confirmed the vendor's fix. Wordfence also published an advisory. This brief does not describe how to craft the upload. Site owners need the version number, the folder to inspect, and a user review after a possible compromise. Why it matters for website owners Elementor Pro is a paid page builder on a very large install base. Coverage often cites about six million sites. That number is reach, not a confirmed victim count. A PHP file in the forms folder is a backdoor. Updating the plugin does not delete files that were written while the old code was live. If you only patch and never look at that directory, you can still be hosting someone else's script. Marketing sites are in scope, not only membership or shop installs. A simple "attach your CV" or "send a screenshot" field on a published form is enough of a door. If you use a host-level rule that blocks PHP in uploads, that helps, but it is not a reason to skip the vendor update. Rules get cloned poorly onto new servers, and staging copies often miss them. Elementor has told some customers that the multiple-file option (off by default) is required for this path. Independent write-ups describe a File Upload field as enough. Until your editor confirms which statement is accurate, treat any live File Upload field on Elementor Pro 4.2.1 or older as in scope. What to check on your site In Plugins, confirm Elementor Pro is 4.2.2 or newer. If you cannot update today, unpublish pages that use an Elementor form with a File Upload field, or remove that field, until you can. On the server, open wp-content/uploads/elementor/forms/ and look for PHP or other executable files you did not place there. Delete anything you cannot explain. Then check Users for unexpected administrators and reset the owner password if logins look wrong. After you patch, run a public WordPress profile with the WordPress Stack Checker on a hostname you own. If you manage several WordPress sites, start with the WordPress Vulnerability Scanner to fingerprint public CMS details before you open each dashboard. If takeover looks likely, scan URLs you authorize with the Website Vulnerability Scanner , then inspect plugins, themes, and uploads beyond the Elementor forms folder. Related reading How to Scan Your Website for Vulnerabilities WordPress Security Hardening: 15 Checks Before You Go Live Sources The Hacker News — August 2026 Patchstack — CVE-2026-32475 advisory