If you run a WordPress site with Elementor Pro, stop what you are doing and check your plugin version. A critical unauthenticated remote code execution vulnerability — tracked as CVE-2026-32475 with a CVSS score of 9.0 — is being actively exploited in the wild against sites running Elementor Pro 4.2.1 and below. Wordfence has already blocked nearly 200,000 exploitation attempts since the flaw was disclosed. This is not a theoretical risk. Attackers are uploading web shells and taking over servers right now.

What Is CVE-2026-32475?

CVE-2026-32475 is an unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin. Discovered by researcher Tin Pham (TF1T) via Patchstack’s bug bounty program, the flaw lives in the Forms module’s File Upload field. The vulnerability allows an unauthenticated attacker to bypass extension validation and upload a PHP web shell to a publicly accessible directory on the server. From there, executing arbitrary commands is a single HTTP request away.

The vulnerability affects every version of Elementor Pro up to and including 4.2.1, meaning this flaw has existed in the codebase for years. Elementor released the fix in version 4.2.2 on August 19, 2026.

How the Exploit Works

The bug is a textbook desynchronization flaw — what security researchers call a “gap between two loops.” Here is how it works at the code level.

Elementor Pro’s Forms module processes uploaded files in two separate passes. The first pass (validation()) checks each file’s extension against an allowed list and a blocklist that rejects PHP and other executable types. The second pass (process_field()) moves validated files into the public wp-content/uploads/elementor/forms/ directory.

The problem is that these two loops disagree about what to do with an empty file entry. When the validation loop encounters an empty file (one with a blank filename, reported by PHP as UPLOAD_ERR_NO_FILE), it hits a return statement that aborts the entire method — meaning it never checks any subsequent file entries. The processing loop, on the other hand, uses a continue statement that only skips that single empty entry and keeps going.

Attackers exploit this by submitting a crafted multipart form with two file parts for the same upload field. The first part is an empty file. The second part is a .php payload. The validator sees the empty part, returns immediately, and never inspects the PHP file. The mover skips the empty part and writes the PHP file into the public uploads directory.

The file lands at wp-content/uploads/elementor/forms/<uniqid>.php where uniqid is a predictable timestamp-based identifier. Once uploaded, the attacker can access the file directly in a browser and achieve remote code execution on the server. No authentication is required at any step — not even a WordPress user account.

Who Is at Risk?

Any WordPress site running Elementor Pro 4.2.1 or below is potentially vulnerable, but there is one important caveat: the attack requires a published page with an Elementor Form widget that includes a File Upload field. If you use Elementor Pro but do not use the Form widget with file uploads, your site is not directly exploitable through this specific vector.

That said, having Elementor Pro installed with a file upload form is extremely common. Job application forms, support ticket attachments, photo upload forms, and document submission forms all use this exact configuration. The field’s “Required” toggle being off is the default state, so no unusual setup is needed to be exploitable.

Elementor Pro has over 6 million active installations, making this one of the most widely exposed vulnerabilities in the WordPress ecosystem this year.

Active Exploitation Confirmed

This is not a vulnerability sitting quietly on a disclosure page. Wordfence has blocked nearly 200,000 exploitation attempts since the patch was released on August 19, confirming that attackers are actively scanning for and targeting vulnerable sites. Security firm Patchstack has also issued mitigation rules, and hosting providers like InstaWP have deployed fleet-wide blocks on PHP execution from the Elementor forms upload directory.

Public proof-of-concept exploit code is available, and multiple security researchers have published detailed technical writeups of the attack chain. If you are running a vulnerable version, assume attackers are already probing your site.

Mitigation and Action Items

• Update Elementor Pro immediately — Upgrade to version 4.2.2 or later. The fix aligns the two loops so an empty entry can no longer bypass the extension check. Extension validation now also runs inside the processing pass itself, right before the file is moved.
• Check for existing compromise — Updating closes the hole but does not remove files that were already uploaded. Inspect wp-content/uploads/elementor/forms/ for any files ending in .php. If you find any, assume the server is compromised and run a full incident response.
• Disable file upload fields temporarily — If you cannot update immediately, unpublish or disable any Elementor Form widget that includes a File Upload field on your live site.
• Block PHP execution in upload directories — As a defense-in-depth measure, add rules to your web server configuration (or a security plugin) that deny PHP execution from the /wp-content/uploads/ tree. Even if a file is uploaded, it cannot run.
• Verify your license status — Elementor Pro will not show an update notice on sites with an expired license. Check your version manually from the Plugins screen or with wp plugin get elementor-pro --field=version via WP-CLI.

The Bottom Line

CVE-2026-32475 is a textbook example of how a seemingly minor coding inconsistency — one keyword difference between return and continue — can open the door to full server compromise. No authentication, no nonce, no special configuration needed. If you run Elementor Pro, patch it now and check for signs of prior exploitation. This is not one to put off until tomorrow.

Quick reference: CVE-2026-32475 | CVSS 9.0 | CWE-434 | Affects Elementor Pro ≤ 4.2.1 | Fixed in 4.2.2