Security incident · 20 Aug 2026
Elementor Pro form uploads let attackers drop a web shell
A file upload flaw in Elementor Pro's Forms widget let attackers write a PHP file to the server without logging in. It was patched August 19, and mass attacks followed in September.
- Component
- Elementor Pro
- CVE
- CVE-2026-32475
- CVSS
- 9
- Affected versions
- ≤ 4.2.1
- Fixed in
- 4.2.2
- Type
- File upload to code execution
- Status
- Actively exploited
- Disclosed
- 20 Aug 2026
What happened
Elementor Pro is the paid version of one of the most used WordPress page builders. Its Forms widget had a file upload flaw, scored 9.0 in the CVE record and 9.8 by Wordfence.
When a form accepted multiple files, an attacker could send an empty file first and a PHP file second. The empty entry made the plugin skip its checks for the rest of the batch, so the PHP file was saved to /wp-content/uploads/elementor/forms/. Visiting it ran the attacker's code. No login needed.
Elementor fixed it in 4.2.2 on August 19. Attacks started in early September, and Wordfence says its firewall blocked more than 190,000 attempts.
Who is affected
- Sites running Elementor Pro 4.2.1 or earlier.
- Only sites with an Elementor Pro form that has a File Upload field with multiple uploads turned on. Elementor says that option is off by default.
- The free Elementor plugin is not affected.
What to do
- Update to Elementor Pro 4.2.2 or later.
- Check
/wp-content/uploads/elementor/forms/for unexpected.phpfiles. - Remove file upload fields from any form that doesn't need one.
- If you find a PHP file there, treat the site as compromised: restore from a clean backup and rotate credentials.
Timeline
- July 16, 2026: Researcher Tin Pham reports the flaw through Patchstack's bug bounty.
- Aug 19, 2026: Elementor Pro 4.2.2 released with the fix.
- Aug 20, 2026: Public disclosure.
- Early Sept 2026: Active exploitation reported by Wordfence (Defiant), BleepingComputer and SecurityWeek.