CVE-2026-32475 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Elementor Pro that lets an attacker upload a PHP webshell through any form built with the Elementor Pro form widget’s file-upload field. It is already being exploited in the wild, it affects every version up to and including 4.2.1, and the fix is in Elementor Pro 4.2.2. If your site runs Elementor Pro with any form on it, update immediately and then check for signs of compromise.
How the Attack Works
Elementor Pro’s form file-upload field validated uploads and processed them in two separate loops that handled an empty upload entry differently. An attacker submits a multipart request with an empty first file part followed by a PHP payload for the same field. Validation sees the empty entry and returns early — but the file-movement code still moves the PHP file into a public directory, wp-content/uploads/elementor/forms/. From there the attacker requests the file directly and executes arbitrary code on the server. No login, no existing access, nothing but a public form.
Affected Versions
| Elementor Pro version | Status |
|---|---|
| 4.2.1 and earlier | Vulnerable — update now |
| 4.2.2 or later | Patched (released August 19, 2026) |
As of early September, roughly two-thirds of Elementor’s install base — on the order of millions of sites — was still running a vulnerable version.
What to Do Right Now
- Update Elementor Pro to 4.2.2 or later. This is the actual fix — a firewall or security plugin reduces exposure but doesn’t close the hole.
- Check
wp-content/uploads/elementor/forms/for any.phpfiles. Legitimate form uploads are never PHP. Anything with a.phpextension there is a webshell. - Review admin users and recently installed plugins/themes for anything you don’t recognize — updating does not remove a payload that was already uploaded.
- Check for unexpected scheduled tasks and modified core files if you find any sign the site was hit before you patched.
If You Find a Webshell
An unfamiliar PHP file in the uploads folder means the site was actively exploited, not just exposed. Updating the plugin at that point locks the door after the intruder is already inside — you need a full incident response. We walk through the concrete steps in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. If you’d rather have someone check a client or business site directly, get in touch.
Frequently Asked Questions
Am I affected if I use Elementor Pro but have no forms?
The exploit path is the Pro form widget’s file-upload field. If you have no Elementor forms with a file-upload field, the direct attack surface is smaller — but you should still update, since a form can be added at any time and the vulnerable code ships with the plugin regardless.
Does the free Elementor plugin have this vulnerability?
No. CVE-2026-32475 is specific to Elementor Pro’s form widget, which is a paid-only feature. The free Elementor plugin doesn’t include it.
I updated to 4.2.2 — is that enough?
It closes the vulnerability going forward, but it doesn’t undo an earlier compromise. If your site was on a vulnerable version while the exploit was circulating, check the uploads folder and admin accounts before considering it resolved.
Featured image: original illustration.