Elementor Pro Had a Critical File Upload Vulnerability. Here Is How to Check

Elementor Pro shipped a fix on August 19, 2026 for a critical vulnerability, tracked as CVE-2026-32475 with a CVSS score of 9.0. If you build client sites with Elementor Pro, or you run one yourself, I would check this today, not next week. This one is unauthenticated, which means an attacker does not need any login at all to use it.

What actually happened

The flaw sits in the Forms module's file upload field. Elementor Pro validates uploaded files in one loop and then moves them into place in a separate loop, and the two loops disagree about how to treat an empty entry in a multi-file upload. By crafting a multi-part upload with a blank first entry followed by a PHP file, an attacker could slip past the extension check entirely. The PHP file still gets written into a public, guessable folder inside your uploads directory. From there, it can just be executed directly by visiting its URL.

Elementor's own changelog for version 4.2.2 lists this simply as "Improved code security enforcement in Form widget," which is typical, understated changelog language for what is actually a serious remote code execution fix.

Who is actually affected

This is specific to Elementor Pro, the paid plugin, not the free Elementor page builder. If you only have Elementor installed without the Pro add-on, this particular issue does not apply to you. Any Elementor Pro site running version 4.2.1 or earlier is affected, regardless of whether the Forms widget's file upload feature is something you actively use, since the vulnerable code path exists in the plugin itself.

The catch nobody else is writing about: the licence trap

Here is the part I think matters most for anyone managing client sites. Elementor Pro requires an active licence to receive plugin updates. If a client's licence has lapsed, which happens constantly on sites built once and rarely revisited, the update button in WordPress simply does not work. The site keeps rendering normally, so nothing looks broken. Meanwhile it stays on a vulnerable version indefinitely, and no amount of clicking "update now" fixes it until the licence itself is renewed and reconnected.

If you manage sites for other people, I would treat this as a reason to check licence status across your whole client list right now, not just plugin version numbers. A site that looks current in every other way can still be silently stuck here.

How to check your own site

Log into WordPress and go to Plugins, then Installed Plugins. Find Elementor Pro in the list and read the version number underneath it. Version 4.2.2 or higher means you are patched. Anything at 4.2.1 or below needs the update applied immediately, licence permitting.

After updating, it is worth checking whether anything already landed on your server before the patch. Look inside wp-content/uploads/elementor/forms/ for any file that does not belong there, especially anything ending in .php or with an unusual, random-looking filename. Finding one there means you are dealing with an actual compromise, not just a missing patch, and that calls for a proper cleanup, not just an update.

A hardening step worth doing regardless of this specific CVE

This vulnerability will get patched and eventually forgotten, but the underlying pattern, a plugin writing an uploaded file into a public, web-accessible folder, is not unique to Elementor. I would add a server-level rule that blocks PHP execution inside upload directories entirely, so that even a future, unknown vulnerability in some other plugin cannot turn an uploaded file into running code.

For Nginx, add this inside your site's server block.

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

For Apache, drop this into a .htaccess file inside the uploads folder itself.

<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

Legitimate WordPress uploads are almost never meant to be executable PHP files, so this rule should not interfere with normal site operation, and it closes off an entire category of future upload-based attacks, not just this one.

FAQ

Do I need to have the file upload feature turned on to be at risk?
The vulnerable code exists in the plugin itself regardless of whether you actively use the multiple file upload option on a form. I would not assume you are safe just because you never touched that setting.

Has this been actively exploited?
At the time I am writing this, there is no confirmed report of widespread in-the-wild exploitation, but a working proof of concept has already been published publicly, which meaningfully raises the risk of that changing soon.

What if I cannot renew a client's licence right away?
Apply the server-level PHP execution block described above as an immediate stopgap. It does not fix the underlying plugin vulnerability, but it does prevent the specific attack technique from working, which buys you time until the licence situation is sorted out.

Should I check other Elementor add-ons too?
It is worth a quick look, yes. Third-party Elementor add-ons are separate plugins with their own update cycles and their own vulnerability history, so a patched Elementor Pro does not guarantee every add-on around it is current.

How do I know if a file I found in the uploads folder is actually malicious?
Any executable file type, especially .php, sitting inside what should be a plain media uploads folder is a strong warning sign on its own. If you are not confident reading the file's contents yourself, treat it as a compromise and bring in someone who can do a proper incident review rather than just deleting it and hoping that was enough.

Bottom line

Update to Elementor Pro 4.2.2 today if you have not already, and actually check the version number rather than assuming an automatic update already handled it. Check licence status on every client site you manage, since that is the one thing that silently defeats the fix. Then add the PHP execution block to your uploads folder, since that single server rule protects you against this entire category of vulnerability going forward, not just this one CVE.

Sources: WPScan, Elementor Pro WordPress Plugin Security Vulnerabilities; Elementor Pro official changelog. Verified against the official changelog and vulnerability database listings on August 30, 2026.