A critical vulnerability in the popular Elementor Pro WordPress plugin is exposing sites to remote code execution by allowing unauthenticated attackers to upload arbitrary files through the Forms module’s file upload feature, tracked as CVE-2026-32475 and rated with a CVSS v3.1 base score of 9.0[6][1][4].
The flaw is classified as an “Unrestricted Upload of File with Dangerous Type” issue (CWE-434) in the Forms widget’s File Upload field, where validation and processing are handled in separate code paths that treat empty file entries differently, enabling a crafted multipart request to bypass checks and drop a PHP payload directly into the site’s uploads directory[6][5][8][11]. Once the malicious file is written, an attacker can call it over the web and execute code in the context of the WordPress server, effectively gaining full control over the site[11][1].
According to multiple vulnerability databases, the bug affects Elementor Pro from its initial releases through version 4.2.1, and is remediated in version 4.2.2, which Elementor shipped on 19 August 2026[6][1][2][3]. Security researchers note that exploitation requires only a published page containing an Elementor Pro Form widget with a File Upload field, particularly where the multiple file upload option is enabled, while sites that do not use that configuration remain unaffected even if they run a vulnerable plugin version[7][3].
Public exploit code demonstrating unauthenticated arbitrary file upload to remote code execution has already been released, making the vulnerability effectively weaponized for mass scanning and opportunistic attacks by threat actors[8][11]. At the time of writing, monitoring services and vulnerability feeds report no confirmed cases of active exploitation in the wild, but warn that the combination of a widely deployed plugin and a trivial, unauthenticated attack path makes that likely to change quickly[7][9].
If successfully exploited, the bug allows attackers to run arbitrary PHP on the server with the privileges of the web process, enabling actions such as installing backdoors, exfiltrating database contents, modifying site content, or using compromised WordPress instances as launchpads for further attacks against visitors or neighboring infrastructure[11][1]. Hosting providers and MSPs that manage large numbers of WordPress sites are particularly exposed, as a single overlooked vulnerable form can provide adversaries with a scalable foothold across multiple customer environments[5][10].
Defenders are urged to upgrade Elementor Pro to version 4.2.2 or later immediately, then audit their sites for any forms that accept file uploads and review the wp-content/uploads/elementor/forms/ directory for unexpected PHP or executable files. Administrators should also enable logging on form submission endpoints, deploy web application firewall rules to flag anomalous multipart requests, and ensure regular backups and incident-response playbooks are in place so compromised sites can be restored and investigated quickly if suspicious activity is detected.
References
- CVE-2026-32475 – Elementor Pro ≤ 4.2.1 – IONIX
- CVE-2026-32475 | Tenable®
- Elementor Pro RCE Flaw CVE-2026-32475 Hits Form Uploads
- CVE-2026-32475: Elementor Elementor Pro: Unrestricted Upload of …
- CVE-2026-32475 – Vulnerability Details – OpenCVE
- CVE-2026-32475 Detail – NVD – NIST
- Critical Elementor Pro bug exposes WordPress sites to …
- CVE-2026-32475 The Elementor Pro Forms File Upload …
- CVE-2026-32475 – Exploits & Severity
- Elementor Pro CVEs and Security Vulnerabilities – OpenCVE
- Unauthenticated Arbitrary File Upload to RCE in Elementor Pro …
