CVE-2026-32475: the Elementor Pro file upload flaw, explained for website owners

Facts checked on 9 October 2026 against the CVE record, NVD, Patchstack, Wordfence and Elementor’s changelog. Sources are listed at the end.

What is CVE-2026-32475?

CVE-2026-32475 is a vulnerability in Elementor Pro, the paid add-on to the Elementor page builder for WordPress. It sits in the Forms module, in the File Upload field that lets a visitor attach a document to a form: a CV with a job application, a photo with a support request, a brief with a quote request.

The field checks what kind of file a visitor is uploading before it saves it. In versions up to 4.2.1, the check and the save read the submission differently, so a deliberately malformed submission could get a file past the check without it ever being inspected. The result is that someone who has never logged in to the site can place a PHP script in a public folder on the server and then run it.

Security researchers call this “unrestricted upload of file with dangerous type”, catalogued as CWE-434. In plain terms, the form’s attachment slot can be used as a door into the server.

The flaw was reported to Patchstack by Tin Pham (TF1T) of VietSunshine Cyber Security Services on 16 July 2026. Elementor fixed it in Pro 4.2.2 on 19 August 2026, and Patchstack published the advisory the same day.

Who is affected?

A WordPress site is exposed to CVE-2026-32475 when all three of these are true:

1. Elementor Pro is installed, at version 4.2.1 or earlier.
2. A page is published that contains an Elementor Pro Form widget.
3. That form has a File Upload field.

No unusual settings are needed. The field is vulnerable in its default state, and Patchstack notes the form does not even need the field marked as required.

The free Elementor Website Builder plugin, which has more than ten million active installations on wordpress.org, does not include the Forms module and is not affected. Elementor Pro is the paid product; BleepingComputer puts it at more than six million active installations. A great many of them use the form builder, because it is one of the main reasons people pay for Pro.

If your site uses Elementor and has a contact form, careers page or quote form with an attachment option, assume you are in scope until someone checks the version.

What can an attacker do?

Take over the website. That is not an exaggeration of the risk; it is the risk.

Once an attacker can run their own PHP on the server, they can read the WordPress configuration file, which holds the database password. From there they can create an administrator account, change any content, install more malicious code, read every form submission and customer record the site holds, and use the server to attack others or send spam. In practice attackers plant a web shell, a small script that gives them a permanent back door, so that they keep access even after the site is updated.

Three features of this vulnerability make it worse than most:

• No login needed. The attacker is an anonymous visitor. There is no password to guess and no account to compromise first.
• No user interaction. Nobody at your organisation has to click anything.
• The upload lands in a public folder. Form attachments are saved under wp-content/uploads/elementor/forms/, which is web-accessible by design, so the attacker can call their script directly.

The official score is 9.0 out of 10 on the CVSS 3.1 scale, rated Critical. The vector rates attack complexity as High, which is why it is 9.0 and not 9.8; some news coverage quotes 9.8, but 9.0 is the figure in the CVE record and in NVD. In the real world the difference did not matter: the attack was automated and running at scale within days.

Is it being exploited?

Yes. Wordfence, which runs a firewall on a large share of WordPress sites, reported that exploitation attempts began on 19 August 2026, the day Elementor released the fix, and that its firewall blocked more than 190,000 attempts between 19 and 23 August. By early September it put the total at close to 200,000. Attackers were uploading web shells to the forms upload folder and then running commands through them.

A public proof-of-concept exploit has since appeared on GitHub, which lowers the bar further.

As of the 8 October 2026 edition of the catalogue, CVE-2026-32475 is not listed in CISA’s Known Exploited Vulnerabilities list. That list lags, and it is a United States federal procurement tool rather than a measure of what is happening to Australian websites. Wordfence’s numbers are the better guide here.

What should you do now?

In this order:

1. Find out whether Elementor Pro is installed, and its version. In WordPress, go to Plugins. Look for “Elementor Pro”. The version number is on the row. Anything below 4.2.2 is vulnerable.
2. Update Elementor Pro. Update to the latest release, not just 4.2.2. On 9 October 2026 the latest Pro release is 4.3.1. If the update button is missing, the licence has probably lapsed on someone else’s account, which is its own problem and a common one on inherited sites.
3. Check the uploads folder. Look in wp-content/uploads/elementor/forms/ for any file ending in .php. That folder should only ever hold the documents and images your forms accept. A PHP file there is a strong sign the site has already been compromised.
4. If you find one, treat the site as breached. Updating the plugin will not remove it. Take the site offline or put it behind maintenance mode, restore from a backup taken before 19 August 2026 if you have one, change every password the site holds (WordPress admin accounts, the database, FTP or SSH, and any API keys in the configuration), and have someone qualified review the server for anything else left behind.
5. Record what you did and when. If this becomes an insurance claim, a Privacy Act notification question, or an awkward board paper, you will want dates.
6. Check whether you have forms with File Upload fields you don’t need. Fewer open doors is better regardless of this CVE.

If step one is already beyond what you can find out about your own website, that is the problem this blog exists to talk about. Skip to the bottom.

Why updating is not the whole fix

The update stops new attacks. It does nothing about the seven weeks between 19 August and today in which the site may have been attacked, nor about anything uploaded in that window. Elementor’s own changelog for 4.2.2 describes the fix as “Improved code security enforcement in Form widget”, with no mention of a CVE or a severity, so a site owner reading the update notes would have no reason to look harder.

There is a second half to this. A PHP script uploaded through a form runs as the web server user, which is exactly the low-privileged local foothold that kernel flaws like the one in USN-8903-1 turn into full control of the server. A patched site on an unpatched server has done half the job.

That is the pattern with most serious WordPress vulnerabilities. The fix arrives quietly, the attacks arrive the same day, and the gap between the two is filled by whoever is actually watching the site. For a lot of Australian businesses the honest answer to “who is watching?” is nobody: the host looks after the server, the agency that built the site has moved on, and the plugin updates belong to no one.

What this looks like with BLACKBX

BLACKBX scans every site it looks after daily against published security advisories, including the Patchstack and Wordfence databases that this CVE appears in. When a plugin on a client’s site matches a critical advisory, our developers patch it immediately; lower-severity items are done at the next service. After an update like this one, we check the uploads folder for anything that should not be there. Every step is dated and recorded in the client’s logbook, so the answer to “were we affected, and what did you do?” is a page, not a phone call.

On the Monitor plan, you get the same scan and the finding goes to your own developer with the version numbers and the advice above. On Maintenance and Full service, we do the work.

Timeline

Sources

• CVE-2026-32475 record, CVE Program (assigned by Patchstack)
• CVE-2026-32475 at NVD, National Vulnerability Database
• Critical unauthenticated file upload to RCE in Elementor Pro plugin, Patchstack, 19 August 2026
• Elementor Pro ≤ 4.2.1 vulnerability entry, Wordfence Intelligence
• Critical Elementor Pro flaw exploited to take over WordPress sites, BleepingComputer, 3 September 2026
• Elementor Pro changelog, Elementor
• Known Exploited Vulnerabilities Catalog, CISA, checked 9 October 2026