Security reports have warned of a critical vulnerability in the Elementor Pro plugin for WordPress sites that could allow attackers to upload executable files and run PHP code remotely on the server. The vulnerability is identified as CVE-2026-32475 and affects Elementor Pro versions older than 4.2.2.
The issue is related to the File Upload module. The plugin uses two separate loops to validate and process files, but the loops handle an upload part with an empty name differently. According to a report by Patchstack, a company specializing in WordPress ecosystem security, this difference can be exploited by creating a multipart upload request that appears valid to the validation mechanism, while the processing mechanism allows a malicious file in a later part of the request to pass through.
How Can the Flaw Be Exploited?
The scenario begins with a published form on the site that includes a file upload field, with multiple uploads enabled. The attacker places an unnamed first part, followed by a malicious PHP file. During validation, processing stops after the empty part because of the UPLOAD_ERR_NO_FILE error, so the subsequent payload is not inspected. The processing stage, however, skips the empty part and continues handling the malicious file, then moves it to the public directory wp-content/uploads/elementor/forms/.
Afterward, the attacker can attempt to determine the name of the file that was created using the uniqid() function. Because this function is time-based and does not actually produce a random value, the name can be inferred through time-related guessing. In some configurations, the automated response message may reveal the file's address directly. When the file is requested at its address, the PHP server interprets its contents and executes the commands with web server privileges.
Which Sites Are Vulnerable?
Elementor Pro has more than 10 million active installations and is the paid version of Elementor, a drag-and-drop website-building tool. The version adds features such as form creation, template and popup building, custom code and CSS insertion, and e-commerce tools.
However, the scope of the risk does not include all sites using the plugin. Elementor explained that the vulnerability affects only sites using an Elementor Pro form containing a file upload field, with the multiple-file upload option enabled, which is disabled by default. The company said that other sites are not affected by this vulnerability, while recommending that users update the plugin to reduce the risks of security or compatibility issues.
What Should Administrators Do?
Patchstack reported the vulnerability to the Elementor team on July 16, 2026, after it was discovered by researcher Tin Pham. The plugin developer prepared a fix the following day, and Patchstack verified it on August 3 before it was made available on August 19. The company has not yet observed any active exploitation of the vulnerability in real-world attacks.
- Update Elementor Pro: Install version 4.2.2 or any later available version.
- Inspect the public directory: Review wp-content/uploads/elementor/forms/ for PHP files or other unknown files.
- Investigate suspicious files: The update does not delete files that may have been uploaded during the exposure period, so they must be examined and removed according to incident response procedures.
The practical significance of the vulnerability is that, according to Patchstack, it requires only the presence of a published Elementor form with the appropriate field and settings. Therefore, installing the fix alone is not sufficient to verify the site's integrity if it was exposed to malicious uploads before the update.