Elementor Pro: Unauthenticated File Upload RCE (CVE-2026-32475)

Introduction

Elementor Pro, running on millions of WordPress sites, had a critical vulnerability disclosed as CVE-2026-32475 (CVSS 9.0) in its Forms module’s File Upload handling. The bug lets an unauthenticated attacker upload arbitrary PHP files and achieve full remote code execution — no login, no special configuration beyond having a published page with a Form widget’s File Upload field.

The flaw comes from a mismatch between two separate code paths: the extension validation check and the actual file-move step run in different loops with different handling of empty file entries. By submitting two file parts for a single upload field, an attacker can slip past the extension blocklist entirely. The uploaded PHP file lands in the publicly accessible wp-content/uploads/elementor/forms/ directory — and from there, it runs.

Notably, the File Upload field’s “Required” toggle is off by default, meaning many sites are exposed without ever intentionally enabling anything risky. Affected versions are prior to 4.2.2, which contains the fix.

What You Should Do Right Now

1. Check if you’re running Elementor Pro and confirm the version under Plugins in wp-admin. Anything before 4.2.2 needs attention.
2. Back up your site immediately before updating.
3. Update to 4.2.2 or later right away.
4. Check wp-content/uploads/elementor/forms/ for any file with a `.php` extension — that directory should only ever contain uploaded documents/images from form submissions, never executable code.
5. Even if you don’t use the File Upload field, check anyway — it being present and unused (with “Required” off) can still leave the endpoint reachable.

Why This One Is Especially Widespread

Elementor Pro is one of the most widely used page builders in the WordPress ecosystem, and its Forms module is a default-available feature on any site using it — not an obscure add-on most people never touch. Combined with the File Upload field being off-by-default-but-present, a huge number of sites could be technically exposed without the site owner ever having deliberately configured anything risky.

FAQ

Do I need to have actively used the File Upload field to be at risk?
Any published page containing a Form widget with a File Upload field can be exposed, whether or not the field is marked required or has ever received a real submission.

How do I check for a planted file safely?
Look in wp-content/uploads/elementor/forms/ via FTP/SFTP or your host’s file manager for any `.php` file. If you find one you don’t recognize, don’t run it — delete it and consider a fuller malware scan.

Is the free Elementor plugin affected too?
This specific flaw is in Elementor Pro‘s Forms module. If you’re only running the free Elementor plugin without Pro, this particular CVE doesn’t apply, but it’s still worth keeping every plugin updated.

Conclusion

A default-reachable, unauthenticated RCE on one of the most-installed WordPress plugins in existence is a top-priority update. Patch to 4.2.2+, then check your uploads folder for anything that shouldn’t be there.