Update Elementor Pro to 4.2.2 today. CVE-2026-32475 is a critical unauthenticated file upload flaw in the Forms module that affects every version of Elementor Pro ever shipped up to and including 4.2.1, and it was patched on 19 August 2026. Then check wp-content/uploads/elementor/forms/ for PHP files, because updating closes the hole but does not undo anything that already got through.
By Cody Wise, founder of Wise Media. Last updated 31 August 2026.
Summary
- What it is: CVE-2026-32475, an unauthenticated arbitrary file upload in Elementor Pro that can lead to remote code execution. Patchstack scores it CVSS 9.0, critical.
- Who is affected: sites running Elementor Pro at version 4.2.1 or lower. The free Elementor plugin is not the one at issue.
- The fix: Elementor Pro 4.2.2, released 19 August 2026.
- The catch nobody writes about: Elementor Pro is a licensed plugin. If the licence on the site has expired, the update button does not work, and no host can push the patch for you.
- Exploitation status at time of writing: no confirmed in-the-wild exploitation. A third-party proof of concept has been published publicly, which changes the risk profile.
- After you update: check one folder, then decide whether you need an incident response rather than a patch.
This is written for the person who owns the website, not the person who maintains it. If you have a maintenance retainer, forward this to them and ask for the version number and the folder check in writing.
Table of contents
- What CVE-2026-32475 actually is, in plain language
- Am I affected? The five-minute self-audit
- The disagreement about who is at risk, and why you should assume the wider version
- The lapsed licence trap
- How to check whether you were already hit
- What to do if you find a PHP file
- The dormant site problem
- What this costs in Canada
- Common mistakes
- FAQ
What is CVE-2026-32475?
CVE-2026-32475 is a flaw in the file upload field of Elementor Pro’s form widget that let an attacker send a file the form was supposed to reject. No login, no password, no account on your site. Patchstack, the security company that coordinated the disclosure, scored it CVSS 9.0 and classified it as critical, with the required privilege listed as “unauthenticated.”
What CVSS 9.0 means if you are not a developer
CVSS is a 0 to 10 severity scale. Anything at 9.0 or above is the top band. In practical terms, a critical unauthenticated file upload means a stranger with no credentials could place a file of their choosing on your server, and a PHP file on your server is a program your server will run. That is the difference between someone defacing a page and someone owning the machine.
Two details temper it, and honest coverage should say so. The published vector lists high attack complexity, meaning it is not a trivial one-click exploit. And at disclosure, CISA’s assessment recorded exploitation as “none” observed.
The timeline
| Date | Event |
|---|---|
| 16 July 2026 | Reported to Patchstack by Tin Pham (TF1T) of VietSunshine Cyber Security Services, through the Patchstack Bug Bounty Program |
| 24 July 2026 | Independently discovered and reported to Wordfence by Austin Ginder of Anchor Hosting |
| 3 August 2026 | Patch verified by Patchstack |
| 19 August 2026 | Elementor Pro 4.2.2 released; Patchstack publishes |
| 20 August 2026 | Mainstream security press coverage begins |
Two independent researchers found the same bug eight days apart. That is worth knowing, because it tells you the flaw was findable, not exotic.
Is there a public exploit?
Yes. At the time the first wave of coverage went out, security vendors reported no public proof of concept. That is no longer accurate. A third-party proof of concept has since been published on GitHub, crediting the original researcher’s finding. We are not linking it and not describing how it works.
What matters to you is the consequence: the window between “only researchers can do this” and “anyone can run a script” has closed. Any advice you read that was written on 20 August and says no PoC exists is now out of date.
Am I affected? The five-minute self-audit
Three checks, in order. You need a WordPress admin login and nothing else.
Check 1: which Elementor do you have, and what version
- Log in to WordPress and go to Plugins > Installed Plugins.
- Look for a plugin named Elementor Pro. If you only see Elementor, you do not have the paid plugin and this specific issue is not yours.
- Read the version number underneath the Elementor Pro name.
- 4.2.2 or higher: you are patched. Continue to the folder check anyway if you were on a lower version at any point since 2026.
- 4.2.1 or lower: you are on a vulnerable build. The affected range is every version ever shipped up to 4.2.1, so an old site on 3.x is not safer for being old.
Check 2: do you have a live form with a file upload field
Installing Elementor Pro is not, on its own, enough to be exploitable. The published condition involves a form. Here is how a non-developer finds them.
- Think about where your site accepts an attachment. Careers or “apply now” pages, “send us a photo of the damage” quote requests, support or warranty forms, contest entries, tender or RFP submissions.
- Open each of those pages on the live site, not in the editor, and look for a field with a Choose File or Browse button.
- If you cannot remember every page, go to Pages in WordPress, sort by date, and open anything you have not looked at in a year. Dormant pages are the ones that catch people.
The important nuance: the field does not have to be marked required, and the “Required” toggle is off by default. A file upload field sitting quietly on a careers page you forgot about is the exact pattern here.
Check 3: is the Pro licence active
Go to Elementor > License in the WordPress sidebar. If it says the licence is expired, disconnected or missing, read the licence section below before you do anything else, because your update button will not work.
The disagreement about who is at risk
This is the part most coverage flattens, and you should know about it before you decide how alarmed to be.
| Source | Stated precondition |
|---|---|
| Patchstack (the coordinating CNA) and Wordfence | A published page carrying a form widget with a file upload field |
| Elementor, in its email to subscribers | The above, and the multiple file upload option enabled, which is off by default |
Elementor’s stated scope is narrower than the security researchers’. Elementor also told subscribers that every other Elementor site is unaffected, while still recommending all sites update.
Act on the wider version. Not because the vendor is being dishonest, but because the cost of assuming the wider scope is one plugin update and a two-minute folder check, and the cost of assuming the narrower one and being wrong is a compromised server. When two competent parties disagree about blast radius, the cheap assumption is the safe one.
This is the same reasoning we apply to any ambiguous technical finding on a client site, and it is the reason our website growth and maintenance work patches on disclosure rather than on confirmation of exploitation.
The lapsed licence trap
Here is the failure mode nobody writing about this vulnerability has covered, and it is the one that will actually bite Canadian small businesses.
Elementor Pro is a licensed plugin, and an active licence is required to receive updates. Elementor’s own documentation says you need an active licence to update Pro, and that you must connect and activate the site to receive automatic updates. It is not distributed through the WordPress.org plugin directory, which means:
- Your host cannot push the patch for you, no matter how good their managed WordPress plan is.
- A WordPress auto-update setting will not save you.
- If the licence expired, the update button in your plugins screen is effectively dead. The site stays on a vulnerable build until somebody pays to renew.
Why this hits handed-over sites hardest
Picture the common Canadian small business situation. An agency built the site in 2023 on their own Elementor Pro licence. The project ended, the site was handed over, and the licence either transferred to a client credit card that has since expired or quietly lapsed at the agency. The site kept working perfectly, because Elementor Pro keeps rendering your existing pages after a licence expires. Nothing visibly broke. Nobody looked.
That site cannot be patched at any speed until someone with a credit card gets involved. And because the vulnerable range covers every version ever shipped, being on an old, stable, untouched build is not protection. It is the opposite.
The question to ask your web person today
Not “are we updated,” which gets you a yes. Ask these three:
- Whose name and card is the Elementor Pro licence on, and when does it renew?
- What version is Elementor Pro on right now, as a number?
- Has anyone looked in the Elementor forms uploads folder since 19 August?
Who holds the commercial plugin licences is one of the two things that separates a real maintenance arrangement from an invoice. The other is the response window when something critical lands on a Friday evening. If you are evaluating what you are actually paying for, our website packages and growth plans both spell out licence ownership in writing, and that is not a detail.
How to check whether you were already hit
Updating stops future attempts. It does not tell you whether one already landed. Because the vulnerable range covers every version ever shipped, “we updated quickly” is not evidence that you are clean.
The folder to check
Files submitted through Elementor form uploads land in:
wp-content/uploads/elementor/forms/You can reach it through your hosting control panel’s File Manager, or over SFTP. You are looking for anything that is not a file type your forms actually accept. If your careers page takes PDFs and Word documents, then a PDF is expected and a .php file is not. Anything ending in .php is the clearest red flag.
Note that the original filename is discarded on upload, so files here have machine-generated names by design. Do not treat an unfamiliar filename as suspicious on its own. Treat the extension as the signal.
What Patchstack itself says to do
Patchstack’s guidance is direct: update to 4.2.2 or later, and sites that ran a vulnerable version with a public file upload form should review that folder for anything outside the document and image types their forms accept, in particular files ending in .php.
Other vendors add sensible interim measures: put a WAF in front of upload requests if you cannot update immediately, review whether each form genuinely needs a file upload field at all, and watch for unusual outbound activity or new administrator accounts appearing.
What to do if you actually find a PHP file
This is the section every other page on this topic is missing. They all tell you to look. None of them tell you what to do when you find something, which is the only reason a worried owner is searching in the first place.
Do not just delete it. Deleting the file removes your evidence and, more importantly, does not remove anything the attacker did with it. Sucuri’s guidance on cleaning a hacked WordPress site is blunt about this: it is critical that all backdoors are closed, or the site gets reinfected quickly.
The order of operations
- Take a full backup first, before you touch anything. Files and database. You want a preserved copy of the compromised state.
- Preserve your server logs. Access logs are how anyone determines what was requested and when. Many hosts rotate them within days. Ask your host to retain or export them now.
- Bring in someone who does incident response. Not the person who builds your pages. This is a different job.
- Assume credential compromise. Change WordPress user passwords, FTP and SFTP, SSH, hosting control panel and database credentials.
- Rotate the salts and keys in
wp-config.php. This is the step people skip. If an attacker holds a valid session cookie, a password reset alone does not lock them out. - Remove any administrator, FTP, SSH or hosting email accounts you do not recognise.
- Check every other site on the same server. Cross-site contamination on shared hosting is a leading cause of reinfection.
- Replace core, plugin and theme files from clean official copies rather than hand-editing what is there.
The Canadian Centre for Cyber Security’s incident response guidance adds one habit worth borrowing even at small scale: conduct your incident communications out of band. If you suspect the environment is compromised, do not coordinate the response inside it.
The dormant site problem
Most Canadian small businesses do not run one website. They run one website they think about and two or three they do not: the old brochure site on a domain they never redirected, the microsite from a 2022 campaign, the location page for a business line they closed.
Those are the sites most likely to be on Elementor Pro 3.x with an expired licence and a live contact form. Nobody logs in. Nobody sees the update notice. They are not less exposed for being ignored, and because they usually share hosting with the site that matters, they are a route to it.
Practical move: list every domain your business owns, note which ones resolve to a live WordPress install, and either patch them or take them down. A site with no business purpose is not neutral. It is unattended surface area.
What this costs in Canada
Ranges below are typical published Canadian market rates for this class of work, in CAD. Verify against actual quotes, since providers vary widely.
| Item | Typical CAD range | Notes |
|---|---|---|
| Elementor Pro licence renewal | Published on elementor.com, priced in USD | Budget for the exchange rate. Check the current tier before assuming. |
| Update and folder check, one site | Under an hour of billable time | Genuinely small if nothing is found |
| Malware scan and clean-up, one site | Several hundred to low four figures | Depends entirely on what is found |
| Ongoing WordPress maintenance retainer | Published market rates run a wide monthly range | Ask specifically what is included, not just the price |
The comparison that matters is not the retainer against zero. It is the retainer against the clean-up, the downtime, and the reputational cost of a Canadian business site serving malware to its own customers.
Common mistakes
- Assuming the free Elementor plugin is the problem. It is Elementor Pro. Check which one you have before you panic or relax.
- Assuming an old site is a safe site. The affected range is every version up to 4.2.1. Age is not protection here.
- Updating and considering it handled. The patch closes the door. It does not check whether anyone came through it.
- Deleting a suspicious file immediately. You destroy the evidence and leave the actual problem in place.
- Trusting “we auto-update everything.” Auto-update cannot touch a licensed plugin with a lapsed licence.
- Reading only the 20 August coverage. The no-public-exploit statement in those articles no longer holds.
- Checking your main site and stopping. The forgotten sites are the exposed ones.
Frequently asked questions
I use the free Elementor plugin. Am I affected by CVE-2026-32475?
No. This vulnerability is in Elementor Pro’s Forms module, which is a paid feature. If Plugins > Installed Plugins shows only “Elementor” and not “Elementor Pro,” this issue is not yours. Keep the free plugin current anyway.
What version of Elementor Pro fixes it?
Elementor Pro 4.2.2, released 19 August 2026. The changelog for that release records security enforcement improvements in the Form widget and in Dynamic Tags. Any version at or above 4.2.2 is patched.
My Elementor Pro licence expired. Can I still get the security update?
No. Elementor’s documentation states an active licence is required to update the Pro plugin. Your existing pages keep rendering, which is why the problem goes unnoticed, but the site stays on a vulnerable build until the licence is renewed and the site reconnected. This is the single most common reason a site cannot be patched.
Do I need a form on my site to be at risk?
The published condition involves a live page carrying an Elementor form with a file upload field. Patchstack and Wordfence state that as the requirement. Elementor’s own statement narrows it further to forms with multiple file upload enabled. Because the two accounts disagree, update regardless of which forms you think you have.
Has this been exploited in the wild?
No confirmed in-the-wild exploitation was reported at disclosure, and CISA’s assessment recorded exploitation as none observed. However, a third-party proof of concept has since been published publicly, so the practical risk is higher now than in the first days of coverage.
Where do Elementor form uploads get stored?
In wp-content/uploads/elementor/forms/. Files there are saved under machine-generated names, so judge them by file extension rather than filename. Anything ending in .php, or any type your forms do not accept, should be treated as a compromise indicator.
I updated the same day. Am I definitely fine?
Updating prevents future attempts, but the vulnerable range covers every version ever shipped, so your site was exposed for as long as it ran a vulnerable build with a qualifying form. Speed of patching is not evidence of a clean site. Do the folder check.
Can my host patch this for me?
Not directly. Elementor Pro is not distributed through the WordPress.org plugin directory, so hosts cannot push it the way they push free plugin updates. Some managed hosts will handle it if they hold your licence credentials. Ask them explicitly rather than assuming.
The bottom line
Three actions, in order: get to Elementor Pro 4.2.2, check wp-content/uploads/elementor/forms/, and find out whose card the licence is on. The third one is what determines whether you can do the first one at all, and it is the question almost nobody asks until the day it matters.
If you own several WordPress sites and cannot answer the version question for all of them right now, that gap is the actual finding here, not the CVE.
Need this handled properly?
Wise Media builds and maintains WordPress sites for Canadian businesses, and we hold plugin licences in the client’s name so this exact situation does not happen. If you want your sites audited, patched and put on a maintenance footing with a defined response window, start with our intake form and tell us how many sites you are running.
Related reading: Elementor vs Gutenberg in 2026, the complete WordPress cleanup and hardening guide, and our website growth packages.
Sources: Patchstack advisory, Elementor Pro changelog, NVD entry for CVE-2026-32475, Elementor licence and update documentation, Sucuri hacked WordPress cleanup guide, Canadian Centre for Cyber Security incident response guidance (ITSP.10.033).
This article is general information about a publicly disclosed vulnerability, not a security assessment of your specific site. If you believe your site has been compromised, engage an incident response professional.