A critical vulnerability in Elementor Pro’s Forms module allows unauthenticated visitors to upload executable files to a WordPress site and, in some cases, run code on the server. Tracked as CVE-2026-32475, the bug is fixed in Elementor Pro 4.2.2. This matters because Elementor Pro is widely deployed and the affected feature—file uploads via forms—is common on contact, support, and job-application pages.
Why it matters: Arbitrary file upload bugs in public-facing form handlers are among the most serious issues for WordPress sites. They can let an attacker place PHP files in a web-accessible directory and execute them, leading to full site compromise.
What CVE-2026-32475 changes
Independent analyses from Patchstack and Wordfence attribute the flaw to a logic mismatch in how Elementor Pro validates and processes uploaded files in the Forms widget’s File Upload field. The validation step and the file-moving step run in separate loops and treat empty file entries differently. Wordfence notes that the validation loop can exit too early when it encounters an empty first entry, skipping extension and type checks for the remaining files. The processing loop then continues and writes a later, unchecked file to disk with its original extension.
Patchstack reports that a crafted multi-part upload can exploit this mismatch so that a PHP file ends up in a public directory (wp-content/uploads/elementor/forms/). They also explain that the resulting filename is based on PHP’s time-derived uniqid(), which may be guessable, and in some configurations the exact URL could be revealed through form autoresponder emails.
The net effect is the classic worst case for upload handlers: a path for an unauthenticated visitor to place—and then request—an executable file on the server.
Who is affected
All known reporting converges on Elementor Pro sites that have a published Form widget containing a File Upload field. There is some disagreement in public write-ups about additional prerequisites:
- Wordfence says exploitation requires a page with a File Upload field that is not marked as required.
- BleepingComputer, citing the vendor’s notice, reports that risk applies to sites using a File Upload field with the multiple file upload option enabled (which the vendor says is disabled by default).
At the time of writing, these conditions appear to differ by source. Site owners should treat any public File Upload field in Elementor Pro as potentially in scope and update promptly.
Current status and identifiers
- CVE: CVE-2026-32475
- Affected versions: Elementor Pro up to and including 4.2.1 (per Patchstack and Wordfence)
- Patched version: 4.2.2 (per Wordfence)
- Severity: 9.8 (Critical), per Wordfence
- Duplicate CVE note: CVE-2026-17590 was rejected as a duplicate of CVE-2026-32475 (per NVD)
- Exploitation: BleepingComputer reported no observed in-the-wild exploitation at publication time
Practical next steps
Based on the evidence from Patchstack, Wordfence, and BleepingComputer, the most reliable actions are:
- Update Elementor Pro to version 4.2.2 or later.
- Manually inspect wp-content/uploads/elementor/forms/ for unexpected PHP or other executable files. Patchstack notes that updating does not remove malicious files uploaded during the exposure window.
- Consider enabling controls that block execution in uploads directories. Wordfence states that its firewall can block attempts when the “Disable Code Execution for Uploads directory” option is enabled.
Caveats and open questions
- Preconditions differ across sources: Wordfence emphasizes a non-required File Upload field, while the vendor (via BleepingComputer) points to multiple-file uploads being enabled. It is not yet clear whether both are necessary or whether either condition alone is sufficient in all environments.
- Some technical details (e.g., whether notification emails expose upload URLs) can depend on site-specific form actions and templates.
Conclusion
CVE-2026-32475 is a high-impact logic flaw in Elementor Pro’s file upload handling that can lead to unauthenticated remote code execution. A patch is available. Update Elementor Pro to 4.2.2 or later and audit the Elementor forms upload directory for any unexpected executable files. Given the conflicting reports on exact prerequisites, err on the side of caution and treat all public File Upload fields as potentially affected until patched.
Sources: Patchstack advisory on CVE-2026-32475; Wordfence analysis and disclosure; BleepingComputer’s coverage and vendor notice; NVD note on the rejected duplicate CVE-2026-17590.
—
Author: Alex Mira, AI Research Writer at Toolslib
Bio: Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Alex helps transform technical cybersecurity and software topics into clear, practical articles for developers, analysts, and everyday users.
Disclosure: Alex Mira is not a real person. Content under this profile may be AI-assisted and should follow Toolslib’s editorial standards.
Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.
Stay Updated with ToolsLib! 🚀
Join our community to receive the latest cybersecurity tips, software updates, and exclusive insights straight to your inbox!
