A critical security flaw in the popular WordPress plugin Elementor Pro has been discovered that could let attackers upload and execute PHP files on vulnerable sites—no login required. The vulnerability, tracked as CVE-2026-32475, affects all versions of Elementor Pro up through 4.2.1; it’s been patched in version 4.2.2.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
Elementor Pro is a paid add-on for the Elementor page builder plugin. Its Forms widget allows site admins to include a File Upload field so visitors can send attachments—think resumes, support requests, or documents. The danger arises from how uploaded files are validated and stored. Under normal operation, the plugin checks file extensions against allowlists and blocklists (rejecting .php, .exe, .asp, etc.).([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
How the Exploit Works
The flaw relates to how Elementor Pro handles uploads when multiple file parts are submitted. An attacker can insert an empty file part first and then follow it with a malicious PHP file. The validation loop stops after seeing the empty part—meaning it never checks later files. The file-processing loop, however, ignores the empty part and goes on to save the PHP file. This unsanctioned PHP file may land in Elementor’s public upload directory, and when accessed, the server could execute it—giving attackers remote code execution with the web server’s privileges.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
This exploit requires no user credentials or admin privileges. The only prerequisites are that the target site uses a public Form widget with a File Upload field—and that the “multiple files” option is enabled (which is off by default).([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
Fixes, Mitigations, and What Site Owners Should Do
The vulnerability has been fixed in Elementor Pro version 4.2.2. This update ensures that file validation and storage happen in the same sequence and adds additional checks right before moving files into upload directories.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/)) Security researchers reporting via Patchstack found the issue, and Patchstack has also issued mitigation rules for users awaiting the patch.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
Site administrators should immediately update affected installations. Additionally, they should inspect the wp-content/uploads/elementor/forms/ folder for unexpected PHP or executable files and remove any that shouldn’t be there. Other recommendations include disabling unnecessary file upload fields, strictly limiting acceptable file types, and ensuring PHP execution is blocked in upload directories.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
At the time of discovery, no public exploits using this flaw had been documented—but its unauthenticated nature makes rapid patching essential to avoid being caught off guard.([cybersecuritynews.com](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/))
Analytical Note: This vulnerability underscores a recurring theme in WordPress plugin security—file uploads remain one of the riskiest features. Even if permissions and blocklists are in place, unexpected interactions (such as empty files bypassing checks) can open dangerous loopholes. Going forward, site owners should treat upload functionality with high caution, audit plugins regularly for security best practices, and favor updates that tighten validation closer to the point files are written to disk. Keeping plugins current is no longer optional—it’s part of maintaining trust, uptime, and safety online.
