Elementor Pro, a page builder installed on an estimated 6 million WordPress sites, shipped a flaw that let anyone on the internet upload an executable file to the server and run code on it. No account and no password were needed. The fix landed on August 19 in version 4.2.2, and site owners should install it.
The flaw is tracked as CVE-2026-32475 and rated 9.8 out of 10, near the top of the severity scale. Wordfence, which received the report through its bug bounty programme and published the analysis on August 20, credits Austin Ginder and Tin Pham as the researchers, and paid a bounty of 15,600 dollars. The write-up is by Wordfence's Istvan Marton. Wordfence says a third party independently reported the same issue to Elementor, which is why it withdrew its own CVE identifier in favour of the one already assigned.
The bug is one misplaced keyword
Elementor Pro's Form widget can accept file uploads. When a form is submitted, the plugin runs each uploaded file through a validation routine that checks the file type and size before accepting it. That routine loops over the files one at a time.
The problem is what happens when it meets an empty upload slot on a field that is not marked as required. The code calls return, which exits the whole function, instead of continue, which would skip that one empty slot and carry on checking the rest. So an attacker who sends an empty first file followed by a PHP file in the same field gets the second file waved through without any extension or file type check at all. Everything downstream trusts a validation step that quietly stopped running.
The submission handler that reaches this code is available to visitors who are not logged in, which is what turns a validation slip into an unauthenticated site takeover. Upload a PHP file, request it, and the server executes whatever it contains.
Not every install is exposed
The 6 million figure is the plugin's install base, not the number of exploitable sites, and the difference matters. Exploitation needs the site to have a published page carrying an Elementor Pro Form widget with at least one File Upload field that is not marked as required. Sites that use the plugin without a form, or whose upload fields are all required, do not meet the condition.
That is worth checking rather than assuming, though. A contact form with an optional attachment field is an entirely ordinary thing to have on a business website, and it is precisely the configuration that qualifies.
Update to 4.2.2
Versions up to and including 4.2.1 are affected. Update to 4.2.2. Wordfence disclosed the issue to Elementor on July 27, three days after receiving it, and the vendor shipped the patched release on August 19. Wordfence also says its firewall's built-in malicious file upload protection blocks exploitation for users on both its free and paid tiers, which buys time but is not a substitute for updating.
If a site was running a vulnerable version with a qualifying form exposed, updating does not undo an upload that already happened. Look for unfamiliar PHP files in the uploads directory and for administrator accounts nobody created.
This is the second unauthenticated file upload flaw in a widely deployed WordPress form plugin in under a week. IntelFusions covered a near-identical flaw in Forminator on August 17, affecting around 600,000 sites, and the shape of the mistake is the same: a validation path that can be persuaded to stop early. Wordfence's full technical analysis includes the vulnerable code. Our roundup of 249 WordPress flaws disclosed in a single week gives a sense of how routine this has become.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.