Elementor Pro shipped version 4.2.2 on August 19, 2026, patching an unauthenticated arbitrary file upload vulnerability in the Forms module’s File Upload field. Tracked as CVE-2026-32475 with a CVSS score of 9.0, the flaw lets an attacker with no login credentials drop a working PHP file into a public directory on any site running Elementor Pro 4.2.1 or earlier. If you run Elementor Pro, updating to 4.2.2 now is the fix, and it’s worth checking your uploads folder for anything that shouldn’t be there.
How the Bug Actually Works
The flaw comes down to two pieces of code disagreeing with each other. When Elementor Pro’s Form widget validates an uploaded file’s extension, that check runs in one loop. When it actually moves the file into place, that happens in a second, separate loop. The two loops handle an empty file entry differently: the validation loop returns early and stops checking, while the move loop just skips past it and keeps going.
An attacker can exploit that gap by sending two file parts for the same upload field in one request: an empty first part, followed by a PHP payload as the second. The empty part trips the early return in validation, so the extension blocklist never actually inspects the real payload. The move loop doesn’t care that validation bailed early, so it processes both parts anyway and writes the PHP file to wp-content/uploads/elementor/forms/, saved under a random filename ending in .php. That file is immediately executable and publicly reachable, no login required.
Security researcher Tin Pham (TF1T) reported the issue to Elementor through Patchstack’s bug bounty program on July 16, 2026. Elementor had a patch ready the next day, verified it by August 3, and released 4.2.2 on August 19, according to Patchstack’s writeup. Neither Patchstack nor The Hacker News‘ coverage mentions confirmed exploitation in the wild as of publication, but a CVSS 9.0 unauthenticated RCE tends not to stay quiet for long once details are public.
Who’s Actually Exposed
Elementor’s own customer notification frames the exposure fairly narrowly, saying it only affects sites with a Form widget’s file upload field where the multiple file upload option is enabled, which is off by default. That’s worth reading carefully. Both Patchstack and The Hacker News describe the actual trigger as an attacker sending two file parts inside one upload request, something the attacker controls on their end regardless of what your form settings look like. The real prerequisite both outlets describe is simpler and harder to rule out: a published page with an Elementor Form widget containing a File Upload field, full stop. That field’s own “Required” toggle is off by default too, so plenty of sites carry one without anyone noticing.
If your site uses Elementor Pro and any form on it has a file upload field, treat yourself as exposed until you’ve updated, regardless of what other upload options you think you’ve left switched off.
What to Do Right Now
- Update Elementor Pro to 4.2.2 or later. This is the actual fix; nothing else closes the gap.
- Check
wp-content/uploads/elementor/forms/for any.phpfiles or other executables that don’t belong there. A real, working payload here is a strong sign the flaw was already used against your site. - If you find something, treat it as a confirmed compromise, not just a cleanup task. Rotate WordPress secrets and admin credentials, and check for other files planted around the same time.
This is exactly the kind of gap a routine Elementor development audit is built to catch before a CVE forces the issue, and it’s a good prompt to review file-upload handling across any custom WordPress development work on the same site while you’re in there.
Frequently Asked Questions
Do I need multiple file upload enabled to be at risk?
No, not based on the technical writeups from Patchstack and The Hacker News. The attacker sends two file parts as part of their own request, which doesn’t depend on your site’s multiple-file-upload setting. If your form has a file upload field at all, update regardless of that setting.
How do I know if my site was already exploited?
Check wp-content/uploads/elementor/forms/ for PHP files or other executable file types that don’t match what your forms are actually supposed to accept. Their filenames will look like random strings ending in .php.
Is there a workaround if I can’t update immediately?
Removing or disabling any Form widget with a file upload field is the only reliable stopgap short of the update itself, since the flaw lives specifically in that field’s handling.
