Elementor Pro flaw let attackers plant executable files on WordPress sites

Key points

• A critical flaw in Elementor Pro, tracked as CVE-2026-32475, let attackers upload and run their own code on affected WordPress sites.
• The bug affects every version of the paid plugin before 4.2.2, and only sites with a published form using the file upload field are at risk.
• Elementor is used on more than 10 million WordPress sites, though only the Pro edition with a specific form option is exposed.
• The vendor was told on July 16 and shipped a fix on November 5, according to disclosure firm Patchstack.
• No live attacks have been spotted yet, but administrators are told to update immediately and check the uploads folder for stray PHP files.

A critical bug in Elementor Pro, the paid version of the popular WordPress website builder, let strangers upload malicious files and take control of a site's server.

The flaw is tracked as CVE-2026-32475 and affects every release before 4.2.2. It was disclosed this week by Patchstack, a security firm that monitors the WordPress plugin ecosystem, and first reported by BleepingComputer.

Elementor is a drag-and-drop tool used to build WordPress sites without writing code. The free version runs on more than 10 million active sites. The Pro edition adds form building, theme design and e-commerce features, and tends to be used by larger commercial sites.

What went wrong?

The bug sits in the plugin's file upload feature. When a visitor submits a form, Elementor Pro checks the files, then moves them into a public folder on the site. Those two steps disagreed about how to handle an upload with a blank filename.

An attacker could send a specially shaped upload where the first slot was empty and the second slot contained a PHP file. PHP is the programming language WordPress runs on, so a PHP file dropped into a public folder can be executed by the server.

The check saw the empty first slot, decided there was nothing to look at, and stopped. The mover skipped the empty slot but happily saved the PHP file into wp-content/uploads/elementor/forms/. Once the attacker knew the file's web address, requesting it made the server run the code, with the same privileges as WordPress itself. That is a full remote code execution, meaning an outsider can run any command they like on the machine.

Guessing the file's name was easier than it should have been. Elementor named uploaded files with a PHP function called uniqid(), which is based on the current time rather than random values. A patient attacker could brute-force the timestamp, or in some setups simply read the URL from an automatic reply email the form sent back.

Which sites are actually at risk?

Only Elementor Pro sites that publish a form with a file upload field and turn on the multiple file upload option are exposed. That last setting is off by default, so most sites are not vulnerable, but the vendor still recommends everyone update.

What should site owners do now?

Update Elementor Pro to 4.2.2 or later, then inspect the wp-content/uploads/elementor/forms/ directory for any PHP files or unexpected content. Patchstack warns that installing the patch does not delete anything an attacker may have already dropped during the exposure window, so a manual check matters.

For ordinary visitors to affected sites, there is no direct action to take. If a site you use was hit, the operator should tell you. Watch for unexpected password reset emails or unusual charges tied to accounts you hold on WordPress-built shops.

Patchstack says no active exploitation has been seen in the wild so far. Public bugs in widely installed WordPress plugins tend to attract scanners quickly, so the window between disclosure and mass probing is usually short.