- The Mess: A critical Elementor Pro vulnerability, CVE-2026-32475, lets an unauthenticated attacker upload a malicious PHP file through the Forms module and potentially execute code on the WordPress server. The bug affects Elementor Pro 4.2.1 and earlier and carries a CVSS 9.0 score.
The nasty part is not the file upload itself.
Elementor Pro’s Forms widget supports file attachments. The vulnerable code validates uploaded files in one loop, then processes them in another. Those two loops don’t agree about what counts as an upload.
That mismatch is enough to bypass the extension checks.
An attacker can abuse a specially crafted multipart request to get a PHP file written into the site’s publicly accessible uploads directory. Once the server executes that file, a simple WordPress plugin vulnerability becomes remote code execution.
No WordPress account is required.
No administrator interaction is required.
And now there is another reason administrators should stop treating this as yesterday’s advisory: a public exploit/PoC appeared on August 25.
That changes the situation.
The vulnerability was already serious when Elementor released version 4.2.2 on August 19. A public PoC makes automated scanning and exploitation considerably easier.
There is also an important scope detail. This affects Elementor Pro, not simply every installation of the free Elementor plugin. The vulnerable functionality is tied to the Pro Forms widget and its File Upload field.
So check the actual plugin.
Don’t just search for “Elementor” in the WordPress dashboard and assume you’re covered.
- The Damage: An attacker who gets PHP execution on a WordPress server can potentially take over the website, steal credentials and data, install persistence, modify files, or use the compromised hosting account to attack other systems.
For a normal WordPress site, that’s already bad.
For a business site, it’s worse.
The attacker may gain access to customer information, forms, administrator sessions, database credentials and API keys. If the hosting environment has weak isolation, the compromised WordPress account can become a stepping stone toward other applications on the same server.
And patching alone may not be enough.
Elementor Pro’s fix is 4.2.2, but updating the plugin does not automatically remove PHP files that an attacker may have uploaded before the update. Security researchers specifically recommend checking the Elementor forms upload directory for unexpected PHP files after patching.
That’s the part many administrators will miss.
Update ≠ clean.
If the site was vulnerable and exposed, investigate it.
- The Fix: Update Elementor Pro to 4.2.2 or later immediately, then inspect
wp-content/uploads/elementor/forms/for unexpected PHP files and review WordPress/server logs for suspicious requests.
If you don’t need Elementor Pro’s Forms File Upload functionality, disabling the affected feature is an additional temporary risk reduction, but it is not a substitute for updating.
Also remember that the free Elementor plugin and Elementor Pro are separate products. Installing or updating the free plugin does not fix an outdated Elementor Pro installation.
Bugstoday Opinion
This is exactly the sort of WordPress vulnerability that gets abused because it requires very little imagination.
There is a public website.
There is a file upload.
There is PHP.
Someone forgot that those three things should never be allowed to casually meet.
The vulnerability itself is bad.
The public PoC arriving today is worse.
And WordPress administrators now have the usual choice: spend five minutes updating the plugin and checking the uploads directory, or spend several hours later trying to figure out why a perfectly normal website suddenly contains someone else’s PHP shell.
Bugstoday verdict: Elementor Pro 4.2.1 belongs in the bin. Update to 4.2.2+, then check whether somebody already dropped a surprise PHP file on your server.
