A high-severity vulnerability has been found in Elementor Pro, the popular WordPress page-builder plugin. This flaw allows unauthenticated attackers to upload malicious PHP files via the Forms module’s File Upload field and gain remote code execution on affected sites. The bug is tracked as CVE-2026-32475 and carries a CVSS score of 9.0 out of 10.0. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
What’s Going On
The issue stems from inconsistent handling of file uploads in Elementor Pro’s Forms widget. Specifically, the plugin uses separate loops for checking file extensions and moving uploaded files, with varying treatment of empty file entries. An attacker can exploit this by submitting two file parts in the same field—one empty and one with a malicious file—which allows them to bypass the extension blocklist entirely and write a PHP file to a publicly accessible uploads directory. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
The vulnerability applies to all versions of Elementor Pro up to and including version 4.2.1. Once exploited, an attacker can upload arbitrary files—including executable PHP scripts—to “wp-content/uploads/elementor/forms/
How Attackers Leverage It
This configuration is extremely common. For example, many WordPress sites include contact forms, job-application forms, support ticket forms, or other forms where users can attach files. In Elementor, the File Upload field’s “Required” setting is off by default, meaning the typical setup already meets the conditions needed to trigger the exploit. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
The discovery was made by security researcher Tin Pham (aka TF1T) under the Patchstack Bug Bounty Program. The issue was reported on July 16, 2026. Elementor issued a patch—version 4.2.2—on August 19, 2026, to address the problem. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
What You Should Do
Sites still running Elementor Pro version 4.2.1 or earlier should update immediately to version 4.2.2. Review all pages with Form widgets that include File Upload fields. If possible, enforce stricter restrictions on file types, disable uploads unless absolutely necessary, and ensure the file upload fields are configured to prevent unauthenticated access.
Additionally, website administrators should regularly scan for unauthorized files—especially unexpected PHP files—in upload directories and monitor for unfamiliar forms or widgets. Auditing user accounts, plugins, and themes for possible compromise is also advised. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
Other recent security news includes WordPress core’s fix in version 7.0.4 for an unrelated high‐severity issue (CVE-2026-65640), which allowed RCE via malicious PostScript file upload by an Author‐level user or higher. That vulnerability affected core versions ranging from 4.7 up to 7.0. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
This Elementor flaw is especially risky because it requires no login or privileged access—just a public form with file upload enabled on an Elementor page. That’s sufficient for attackers to upload PHP and execute code. It puts millions of WordPress sites using Elementor Pro at serious risk. ([thehackernews.com](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html))
Analytical Take: This kind of vulnerability highlights the dangers of complex form handlers and file upload logic. Separating extension validation and file movement, especially with edge cases like empty file entries, opens up a serious attack surface. For site owners, the lesson is clear: keep plugins updated, minimize file‐upload functionality to only where it’s absolutely needed, and audit configurations regularly. For plugin developers, aligning validation and storage workflows—and thoroughly testing edge cases—should be nonnegotiable. The broader message is that ease of use must never overshadow secure architectural design.
