On August 19, 2026, Elementor shipped Elementor Pro 4.2.2, a patch for a file upload vulnerability serious enough to earn a CVSS score of 9.0 out of 10.0: the kind reserved for flaws that need no password, no account, and no click from a visitor to exploit. The bug, tracked as CVE-2026-32475, lived in the Forms module of Elementor Pro, the paid tier of one of the most widely installed page builders in the WordPress ecosystem. Let’s walk through what happened together!
What got patched, and why a 9.0-severity, no-login flaw matters
It’s the second time this year we’ve covered a WordPress flaw serious enough to demand same-day attention, after wp2shell forced an urgent core update under active attack. This one sits in a plugin, not core, but the underlying lesson repeats: a very large install base plus a low bar to exploit is what turns a bug into a headline.
According to Patchstack’s advisory, which credits the discovery to researcher Tin Pham (TF1T) through its bug bounty program, the flaw lived in how the Forms module’s File Upload field validates incoming files. One piece of code checks whether a file’s extension is allowed before accepting it; a separate piece of code moves accepted files into their final folder. On certain malformed submissions, those two checks fall out of sync, letting a disguised file skip the extension check while still reaching the step that saves it. The result: a PHP file written straight into wp-content/uploads/elementor/forms/, sitting in a public folder, ready to run the moment it’s requested by URL.
What makes CVSS 9.0 more than a scary number here is what’s absent from the requirements: no login, no account, no interaction from anyone but the attacker. Elementor Pro’s Forms module already keeps a blocklist of dangerous file extensions specifically to stop this kind of upload. The flaw isn’t a missing safeguard, it’s an existing one that got bypassed, a more unsettling category of bug than a plugin that simply forgot to check file types. Patchstack’s own timeline puts the original report to Elementor at July 16, 2026, which means the fix shipped roughly a month after the vendor first learned about the bug, and a full day before the public disclosure that’s driving this week’s headlines. Sites with auto-updates already enabled were covered before the story broke; sites that aren’t watching for plugin updates may still be running the vulnerable version today.
Are you actually exposed? It depends on one specific feature
Exploiting CVE-2026-32475 requires one precondition: a published page carrying an Elementor Form widget with its File Upload field turned on. If that describes a job-application form, a document-submission form, or a beefed-up contact form somewhere on your site, you’re in the exposed group and updating isn’t optional. If none of your Elementor forms accept file uploads, this particular flaw doesn’t reach you, even while running an older version.
That distinction matters in one more way: the File Upload field lives specifically in Elementor Pro’s Forms module, a paid feature. The free Elementor plugin, the one with more than 10 million active installs on WordPress.org, isn’t affected by this vulnerability at all. If you’re running Elementor without Pro, this advisory doesn’t concern your site, though it’s still worth knowing what your paid-plugin neighbors are dealing with.
Are you patched? A two-minute check
Open your WordPress dashboard, go to Plugins, and find Elementor Pro in the list. If the version number reads 4.2.2 or higher, you’re covered, no further action needed for this specific flaw.
If it still reads 4.2.1 or older, update now: the fix has been available since August 19, 2026, and there’s no reason to wait for a maintenance window on this one. While you’re in the plugin list, check whether auto-updates are turned on for Elementor Pro specifically: WordPress has offered a per-plugin auto-update toggle since version 5.5, and a licensed, paid plugin like this one won’t always default to it the way core itself does.
If you want to go a step further, a quick look inside wp-content/uploads/elementor/forms/ for any file ending in .php that you don’t recognize is a reasonable extra check, particularly if your site has been sitting on an older version for a while.
Our take
Elementor Pro joins a growing list of premium WordPress plugins where a single flaw can reach a very large number of sites at once, precisely because the ecosystem’s biggest strength, a small number of plugins doing the heavy lifting for millions of installs, is also what concentrates the risk when one of them slips. We already covered the broader trend behind rising plugin security bugs, and this advisory fits squarely inside it rather than standing apart from it.
None of that is a reason to drop Elementor Pro, and this isn’t a verdict on the plugin as a whole: a fast, documented patch for a flaw found through a legitimate bug bounty program is closer to the system working than to it failing. THE safest habit here isn’t specific to Elementor Pro: confirm your version, turn on auto-updates where a plugin offers them, and keep a recent backup before any update you apply manually. If you’re re-evaluating which premium plugins deserve a permanent place on your site, our guide to the pitfalls of choosing WordPress plugins is a good place to continue. More than a week after the patch, the only sites still at risk from CVE-2026-32475 are the ones that haven’t checked yet.
Photo: Vanessa Garcia/Pexels.
