Elementor Pro, Critical Vulnerability in Forms: File Upload Could Lead to Code Execution

Vulnerability Allows PHP Script Uploads

A critical vulnerability in Elementor Pro could allow an attacker to upload a PHP file to a WordPress server and execute it remotely. Tracked as CVE-2026-32475, the issue affects Elementor Pro versions earlier than 4.2.2.

The flaw affects the File Upload widget used in Elementor forms. Under specific conditions, an attacker can bypass checks on uploaded content and transfer a script to a publicly accessible directory:

wp-content/uploads/elementor/forms/

The file can then be accessed over HTTP. If the server executes PHP in the affected directory, the code runs with the privileges of the account used by the web server.

The vulnerability has a CVSS score of 9, with the following vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The attack does not necessarily require credentials or user interaction, but it involves high complexity because the request must be crafted carefully and the generated filename must be identified.

Flawed Handling of Empty File Parts Causes the Issue

The technical root cause lies in how Elementor Pro validates and processes parts of a multipart request.

The component uses two separate loops: one checks the received files, while the other actually handles the transfer. These paths do not treat an upload part with an empty name consistently, a condition PHP identifies with the UPLOAD_ERR_NO_FILE error.

A malicious request can begin with a part that has no filename and immediately contain a PHP file afterward. The validator treats the first element as invalid and stops processing, so it never examines the second element.

The processing routine behaves differently: it ignores the empty part and continues processing subsequent content. The PHP file is therefore copied to Elementor’s upload directory even though the earlier validation did not complete its review of the entire request.

The filename is generated using uniqid(). Its value is time-dependent and does not provide true randomness. An attacker can therefore attempt to reconstruct the filename through a time-based brute-force attack. In some configurations, the complete path may also appear in an email automatically generated by the form.

Once the URL has been identified, the attacker can send a request to the file. The server passes its contents to the PHP interpreter and executes the code with the web server user’s permissions.

Who Is Actually Exposed

Elementor Pro is the paid edition of the Elementor WordPress page builder and has more than 10 million active installations. It includes advanced forms, theme and popup tools, custom CSS and code, and components for e-commerce websites, among other features.

However, simply having the plugin installed does not establish exposure to CVE-2026-32475. The site must have:

• at least one published Elementor form;
• a File Upload field within that form;
• multiple-file uploads enabled.

The last setting is disabled by default. Elementor has therefore stated that sites not using this configuration are not affected by this specific vulnerability. Updating is still recommended because it removes the flaw from the component.

The most serious consequence is the potential for server-side code execution. Depending on the available privileges, an attacker could modify pages, replace content, install malware, read data accessible to the web account, and use the compromised site to launch further attacks.

There are currently no reports of active exploitation observed in the wild.

Discovery, Fix, and Status in Risk Catalogs

The vulnerability was discovered by Tin Pham and reported to Patchstack on July 16. The information was then shared with the Elementor team, which prepared a fix the following day.

Patchstack verified the fix on August 3. The verified version was provided the day before the article was published, dated August 20, 2026, at 10:39.

There is no indication that CVE-2026-32475 is included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. There is also no information about any recent Elementor entries in the KEV catalog. The absence of a KEV listing does not eliminate the risk: when the vulnerable configuration is present, the flaw can still enable full site compromise.

What Administrators Should Do

The primary measure is to update Elementor Pro to the latest available version, ensuring it is at least 4.2.2. The update should also be applied to sites where multiple-file uploads are disabled, to avoid leaving a vulnerable version installed.

Administrators should also:

1. identify published forms containing a File Upload field;
2. check whether multiple-file uploads are enabled;
3. inspect the wp-content/uploads/elementor/forms/ directory;
4. look for unexpected PHP files, unusual filenames, or files unrelated to normal site activity;
5. review files uploaded while the plugin was vulnerable;
6. examine HTTP logs for requests to suspicious files in that directory.

Until the update can be applied, disabling multiple-file uploads in affected forms reduces the conditions required for an attack. This is only a temporary mitigation and does not replace the patch.

The update also does not automatically remove any payloads that may already have been uploaded. If suspicious scripts are found, simply deleting them is not enough: administrators should review the logs, look for requests to those files, and inspect the system for persistent changes, modified accounts, or other components introduced by the attacker.