Skip to content
HACKTECH
Web & CMSReported Published 3 sources

Elementor Pro file upload flaw CVE-2026-32475 exploited from the day it was patched

Patchstack disclosed CVE-2026-32475 on 19 August 2026, an unauthenticated arbitrary file upload flaw in the Forms module of Elementor Pro 4.2.1 and earlier that lets an attacker write a PHP file into the uploads directory and run it. Elementor released the fix in version 4.2.2 the same day. BleepingComputer reported that Wordfence blocked more than 190,000 exploitation attempts between 19 and 23 August, with attackers placing PHP files in /wp-content/uploads/elementor/forms/ and then requesting them directly to run commands.

  • WordPress
  • Elementor Pro
  • CVE-2026-32475
  • file upload
  • web shells
  • WordPress plugins

What the sources report

  • Patchstack scores CVE-2026-32475 at CVSS 9.0: when a non-required upload field's first file entry is empty (UPLOAD_ERR_NO_FILE), the validation loop uses return and skips checks on later entries, while the move step uses continue and writes a following .php file to wp-content/uploads/elementor/forms/.
  • Exploitation needs only a published Form widget with a File Upload field left at the default non-required setting; no authentication, cookie or nonce is required and the request uses the elementor_pro_forms_send_form AJAX action (Patchstack).
  • Patchstack's timeline: report received 16 July 2026, vendor patch prepared 17 July, patch confirmed 3 August, version 4.2.2 released and advisory published 19 August.
  • BleepingComputer (3 September 2026) put the install base at more than 6 million active installations and said exploitation began on 19 August, the day 4.2.2 was released.
  • Patchstack's vulnerability database lists CVE-2026-32475 as known to be exploited.
  • Updating does not remove files already written; Patchstack advises checking wp-content/uploads/elementor/forms/ for unexpected .php files, which BleepingComputer describes as a strong indicator of compromise.

What it means for your organisation

Attacks started the day the patch shipped, so sites on weekly or monthly plugin update cycles were still unpatched during the 19 to 23 August period in which Wordfence reported blocking more than 190,000 attempts. The underlying failure, inconsistent validation between checking and storing uploaded files combined with upload folders that execute PHP, recurs across WordPress plugins. Updating closes the hole but does not remove a planted web shell, so any update made after 19 August should be followed by a file check.

What we check

  • Inventory WordPress plugins across all sites, including premium plugins updated outside wordpress.org, and confirm Elementor Pro is 4.2.2 or later.
  • List .php files under wp-content/uploads/elementor/forms/ and elsewhere in wp-content/uploads, and treat any as a compromise indicator.
  • Verify the web server refuses to execute PHP in upload directories.
  • Test public forms with file upload fields for server-side extension and content validation, including multi-file submissions with an empty first part.
  • Check access logs for elementor_pro_forms_send_form requests followed by direct requests to files in the forms upload path.

Sources

Services that cover these checks

  • Website security audit

    A review of a public website's TLS and security headers, third-party scripts, CMS and plugin versions, forms, authentication and hosting configuration. Every check is marked pass, fail or not applicable with the evidence attached, so the result doubles as a compliance artefact.

    Duration: 3 to 6 working days

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works