Elementor Pro form uploads let attackers take over sites (August 2026)
Elementor Pro 4.2.1 and older had a critical flaw, CVE-2026-32475, that let anyone upload a program through a form's file upload field and take over the site. Version 4.2.2 fixed it on August 19, 2026, and attacks began the same day. Update Elementor Pro, then check the forms upload folder for files that shouldn't be there.
- Date
- Severity
- Critical
- Status
- Act now
- CVE
- CVE-2026-32475
- Who’s affected
- WordPress sites running Elementor Pro 4.2.1 or older with at least one published form that has a File Upload field.
What to do
- Update Elementor Pro to 4.2.2 or later, ideally the latest version.
- Check wp-content/uploads/elementor/forms/ for files ending in .php, or anything your forms don't accept.
- If you find one, treat the site as hacked: updating doesn't remove what an attacker already planted.
- Make sure your Elementor Pro license is active, so updates keep arriving.
What happened?
Elementor Pro is a popular paid page builder for WordPress. Its Forms module includes a File Upload field, for things like CVs or photos. In versions 4.2.1 and older, a crafted upload could slip a program file past the checks and onto the site. Requesting that file then ran it on the server, which hands the attacker the site.
Patchstack published the details on August 19, 2026, the day Elementor released the fix in version 4.2.2. It rates the flaw 9.0 out of 10, critical, and needing no login.
Who’s affected?
Sites running Elementor Pro 4.2.1 or older that have at least one published page with a form using a File Upload field. Patchstack notes that’s a common setup. Sites without that field, or without Elementor Pro, aren’t affected by this flaw.
Is it being attacked?
Yes. BleepingComputer reported that attacks started the same day the fix was released, and that Wordfence’s firewall blocked more than 190,000 attempts in the first five days. It’s a clear example of why updates matter: the fix and the attacks arrived together.
What should I do?
- Update Elementor Pro to 4.2.2 or later. The changelog lists the current version.
- Check the uploads folder. Ask whoever maintains your site to look in
wp-content/uploads/elementor/forms/for files ending in.php, or any file type your forms don’t accept. - If something’s there, treat the site as hacked. An update closes the hole but doesn’t remove a program an attacker already planted. See what to do if your site was hacked.
- Keep the license active. Paid plugins stop showing updates when the license lapses.
How does E-3 handle this?
On sites we look after through website care, plugin updates are tested on a staging copy first. Monitoring tracks known plugin vulnerabilities, waiting updates and plugin-license renewals on each hosted site, and we send security alerts and keep daily backups.
Sources
- Critical unauthenticated file upload to RCE in Elementor Pro plugin, CVE-2026-32475 (Patchstack, August 19, 2026)
- WordPress Elementor Pro plugin 4.2.1 arbitrary file upload vulnerability (Patchstack database)
- Critical Elementor Pro flaw exploited to take over WordPress sites (BleepingComputer, September 3, 2026)
- Elementor Pro changelog (Elementor)
Rather we handled security updates for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.