Elementor Pro patch fixes unauthenticated PHP upload vulnerability
Elementor Pro has released version 4.2.2 to fix CVE-2026-32475, a critical vulnerability in its WordPress plugin that could allow unauthenticated attackers to upload PHP files and achieve remote code execution. The issue affects all Elementor Pro versions up to and including 4.2.1 and has a CVSS score of 9.0 out of 10.
Patchstack said the flaw is located in the Forms module’s File Upload field. An attacker can submit two file parts for the same field and exploit inconsistent handling of empty file entries during extension validation and file movement. This can bypass the extension blocklist and place a PHP file in a publicly accessible directory.
How the upload bypass works
The vulnerable workflow performs the file extension check and the move operation in separate loops. Because those loops treat empty file entries differently, the restricted upload control can be turned into an unauthenticated remote-code-execution path. Uploaded files may be written to wp-content/uploads/elementor/forms/<uniqid>.php, with the filename generated by PHP’s uniqid() function.
The stated prerequisite is a published Elementor page containing a Form widget with a File Upload field. Patchstack noted that this is a common setup for job applications, photo, identification or receipt attachments, and support requests. The field’s Required setting is off by default, so exploitation does not depend on an unusual hardened configuration.
Patch availability and related WordPress exposure
Security researcher Tin Pham, also known as TF1T, reported the issue through the Patchstack Bug Bounty Program. Elementor Pro received the report on July 16, 2026, and released the patch on August 19. The finding follows WordPress core remote code execution issue, which describes a WordPress core remote-code-execution issue, while the Elementor defect is specifically tied to the plugin’s Forms upload handling.
WordPress 7.0.4 was released shortly before the Elementor update to address CVE-2026-65640, a high-severity core issue affecting versions 4.7 through 7.0. That flaw involves malicious Postscript uploads and requires both Imagick and Ghostscript on the server, as well as an attacker with the upload_files capability. By contrast, the Elementor issue can be exploited without authentication when the affected form configuration is present.
Actions for site operators
Administrators should update Elementor Pro to 4.2.2, identify published forms that expose File Upload fields, and check the Elementor forms upload directory for unexpected PHP files. They should also audit unknown accounts and plugins and investigate unauthorized modifications that produce redirects or pop-ups. For businesses relying on attachment-enabled public forms, rapid patching and a focused review of uploaded files are the practical steps to reduce exposure.