Critical Elementor Pro Vulnerability Could Allow Remote Code Execution

A critical security flaw in Elementor Pro could allow unauthenticated attackers to upload malicious files to vulnerable WordPress websites and potentially take control of the underlying server.

Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro 4.2.1 and earlier and carries a CVSS score of 9.0. Patchstack disclosed the issue on August 19 after Elementor released a fix in version 4.2.2.

Elementor Pro is the premium extension of the widely used Elementor WordPress website builder. Wordfence estimates the Pro plugin has approximately 6 million active installations, giving the vulnerability a potentially large attack surface.

How the Flaw Can Lead to Remote Code Execution

The vulnerability affects the File Upload field in Elementor Pro’s Forms module.

Normally, Elementor checks uploaded files against allowed and blocked file extensions before moving them to the website’s uploads directory. However, researchers found that the validation process and the file-processing process handle empty upload entries differently.

An attacker can exploit this mismatch by submitting specially structured file entries that cause validation to stop before checking a malicious file. The processing routine can then continue and save the unchecked file anyway.

This can allow an unauthenticated attacker to upload an executable PHP file into a publicly accessible Elementor uploads directory. If the attacker locates and requests that file, it can result in remote code execution and potentially complete compromise of the WordPress site.

The attack is relevant to sites containing a publicly accessible Elementor Form with a File Upload field, particularly when the field is not required, which Patchstack notes is the default configuration.

Elementor Pro Users Should Update Now

Administrators running Elementor Pro should update to version 4.2.2 or later as soon as possible.

Because successful exploitation can leave a malicious file behind, updating alone will not remove anything previously uploaded. Sites that ran affected versions should also review the Elementor forms upload directory for unexpected files, particularly executable PHP files.

The vulnerability demonstrates how a small difference between validation and processing logic can turn a routine file-upload feature into a serious security risk.