A critical vulnerability in the Elementor Pro WordPress plugin — CVE-2026-32475 — allows an unauthenticated attacker to upload a PHP file to a publicly accessible directory on the web server and then request it to execute arbitrary code. Elementor Pro is the paid tier of the Elementor page builder, which has more than 10 million active installs; the Pro version is widely used by agencies and higher-traffic sites for advanced form handling, e-commerce tools, and custom code injection. The flaw was discovered by researcher Tin Pham, reported to Patchstack on July 16, and fixed in Elementor Pro 4.2.2 released August 20.
The vulnerability lives in the plugin’s file upload module, which runs two separate loops — one for validation, one for processing — that disagree on how to handle an upload entry with a blank filename. When an attacker crafts a multipart upload where the first entry has an empty filename followed by a malicious PHP payload, the validator quits early on the empty entry (treating it as no file uploaded) and never inspects the PHP in the second part. The processing loop skips the blank entry but continues and moves the PHP into wp-content/uploads/elementor/forms/, a public directory. The attacker can then recover the uploaded filename — it uses PHP’s time-based uniqid() function, so it is predictable — and trigger execution by fetching the file. Exploitation requires only that the targeted site has a published Elementor form with a File Upload field enabled; no account or login is needed.
How to check if you’re affected
Affected versions are Elementor Pro before 4.2.2. To check: in your WordPress admin panel go to Plugins → Installed Plugins, find Elementor Pro, and verify the version shown. If it reads anything earlier than 4.2.2, click Update Now or download 4.2.2 from the Elementor account portal. Also audit wp-content/uploads/elementor/forms/ for any .php files — their presence indicates a prior exploitation attempt. Delete any you find, and consider scanning with a WordPress security plugin such as Wordfence or Sucuri to check for webshells elsewhere on the server.