On this page (7 sections)
Patchstack published research on August 19, 2026 describing an unauthenticated arbitrary file upload flaw in the Elementor Pro plugin that can lead to remote code execution. The bug sits in the Forms module's File Upload field and is tracked as CVE-2026-32475.
If your WordPress site uses Elementor Pro forms with a file upload field, treat this as a priority. At the time of writing, Patchstack is the only publisher we found covering it, so some details below are marked as unconfirmed.
What happened
Patchstack reports that an unauthenticated visitor can bypass the file extension blocklist in Elementor Pro forms and write a PHP file into a publicly reachable directory. A PHP file in a web-accessible location is the classic route to remote code execution, meaning an attacker could run their own code on the server. The issue was reported to Patchstack by Tin Pham (TF1T). Patchstack says it has issued mitigation rules for its own users.
Technical details in plain terms
The Forms module handles an uploaded file in two separate steps. One loop checks each file's extension against an allowed list and a blocklist that includes PHP and other executable types. A second loop then moves each accepted file into the public forms directory. The check itself is sound; the problem is that the two loops disagree about empty file entries, meaning upload parts with a blank filename.
According to Patchstack, the validation loop exits the whole method when it meets an empty entry on a non-required field, so every later entry goes unchecked. The processing loop, by contrast, only skips that one empty entry and carries on to move the remaining files. By submitting two file parts for the same field, with an empty one first, an attacker can have a file skipped by the validator but still moved by the processor.
This is a validation and processing mismatch, a common weakness class: security checks and the action they protect are written as separate code paths that drift apart. We are intentionally not describing request details beyond what is needed to understand the risk.
Who is affected
- Sites running Elementor Pro 4.2.1 or earlier.
- Sites that use the Forms widget with a File Upload field, such as job application, support ticket or contact forms with attachments.
- Because no login is needed, exposure does not depend on user accounts or roles.
Sites using only the free Elementor plugin are not described as affected in the research, which concerns Elementor Pro. Whether the flaw can be reached on a form without a File Upload field is not addressed by the source, so check every form.
How to check your exposure
First confirm which Elementor Pro version you run. This WP-CLI command lists the plugin and its version; run it from your WordPress directory and look for a version of 4.2.1 or lower.
wp plugin list --name=elementor-pro --fields=name,status,version,update_versionIf the plugin slug differs on your install, this command lists all plugins with their versions and available updates, so you can find the Elementor Pro entry.
wp plugin list --fields=name,status,version,update,update_versionNext, review your forms in the Elementor editor and note which ones include a File Upload field. Then look for unexpected files. This read-only command lists PHP files under the uploads directory, where PHP files are normally not expected; any result deserves a closer look. The research does not name the exact forms upload folder, so search the whole uploads tree.
find wp-content/uploads -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.pht' \) -printWhat to do now
0 of 7 done
The research does not state which version fixes the issue, so do not assume a specific number. Check the Elementor Pro changelog and your account dashboard for the current release. If a suspicious PHP file turns up, follow our guide on what to do when a website is hacked, because deleting one file rarely removes every backdoor.
Detection and monitoring
After patching, keep watching for signs that something was planted before you updated. A scan of your public pages can reveal injected content or known malicious patterns, though it cannot see every file on the server; see what outside-in malware detection can and cannot see. The free malware scanner is a quick first check, and our guide to checking if a website is hacked covers manual steps.
A web application firewall can add a layer of protection while you patch, but it is not a substitute for updating. Patchstack states it has its own mitigation rules; we have no information on rules from other vendors for this specific flaw. For background, see what is a WAF.
Open questions
- Fixed version: not stated in the research.
- In-the-wild exploitation: not reported in the research.
- CVSS 9.0 is the score shown by Patchstack; the research does not say who assigned it, and no NVD or CISA KEV record was available.
- Only one independent publisher covers this so far, so treat details as preliminary until the vendor publishes its own advisory.
For habits that reduce the impact of the next plugin flaw, see our WordPress security checklist.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.