Critical Elementor Pro flaw allowed PHP uploads

Security firm Defiant reported active exploitation of a critical arbitrary file upload vulnerability in Elementor Pro that lets unauthenticated users place and run PHP files on affected WordPress sites. The flaw is tracked as CVE-2026-32475 with a CVSS score of 9.8.

The bug is in the Form widget’s File Upload handling. When the plugin’s form-processing code encounters an empty entry in an upload field array, it returns early and skips validation for subsequent entries. An attacker can submit the field as an array with an empty slot followed by a PHP payload; the payload is written to disk without the plugin’s usual checks and can then be requested to execute on the server.

Files placed by successful exploit attempts appear in the uploads folder used by Elementor forms at /wp-content/uploads/elementor/forms/. Defiant noted that such a .php file in that directory is a strong indicator of compromise. The company wrote: “An unauthenticated attacker can request the uploaded file to execute their PHP payload on the server.”

The vulnerability affected all Elementor Pro versions up to 4.2.1. A fix was released in version 4.2.2 on Aug. 19. Defiant reported that attackers began probing sites immediately after the update and that its protections have blocked more than 190,000 exploit attempts.

Elementor’s free plugin has more than 10 million installations, and Elementor Pro has over 6 million active installs. According to WordPress data cited by Defiant, about two-thirds of Elementor installations were running a vulnerable version as of Sept. 4.

Site administrators are advised to upgrade to Elementor Pro 4.2.2 or later. Defiant recommends checking the /wp-content/uploads/elementor/forms/ directory for any .php files, reviewing server logs for requests to /wp-admin/admin-ajax.php, and scanning sites for backdoors if compromise is suspected.

Where immediate updates are not possible, temporary steps include restricting write and execute permissions on the uploads directory and applying web application firewall rules to block suspicious requests to admin-ajax.php. If a site shows signs of compromise, administrators should remove malicious files, rotate credentials, and restore from a known-clean backup while conducting a full incident response.