A critical vulnerability in Elementor Pro, the paid version of the widely used WordPress page builder plugin, could allow attackers to upload and execute arbitrary PHP code on affected websites. Tracked as CVE-2026-32475 and carrying a CVSS score of 9.0, the flaw resides in the plugin’s Forms module File Upload feature and affects all versions before 4.2.2.

According to researchers at Patchstack, the bug stems from inconsistent handling of empty file uploads between two separate code paths: one that validates uploaded files and one that processes and moves them. When a multipart upload contains an empty filename entry (which PHP flags as UPLOAD_ERR_NO_FILE) followed by a malicious PHP payload, the validation loop stops checking after the first, empty entry. The processing loop, however, continues past it and moves the malicious file into the publicly accessible directory wp-content/uploads/elementor/forms/.

Exploitation requires only that a target site have a published Elementor form with a File Upload field and the multiple file upload option enabled, which is disabled by default. Once the PHP payload is uploaded, an attacker still needs to locate its filename, which is generated using PHP’s uniqid() function. Since this function is time-based rather than random, attackers can brute-force the filename through timing analysis, and in some configurations may obtain the exact URL via an autoresponder email. Requesting that URL causes the server to execute the file with web server privileges.

Disclosure and Fix

Researcher Tin Pham reported the flaw to Patchstack on July 16, which relayed it to Elementor. A fix was prepared the next day, verified by Patchstack on August 3, and released to customers shortly after. Elementor has notified subscribers that only sites using an Elementor Pro Form with an upload field and multiple file uploads enabled are at risk, though it recommends all users update regardless to avoid compatibility issues.

No active exploitation has been reported at this time.

Recommendations

  • Update Elementor Pro to version 4.2.2 or later immediately
  • Inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP or executable files
  • Note that patching does not remove files uploaded during the exposure window; a thorough manual review is required
  • Disable the multiple file upload option on forms if not strictly needed