A file upload field on a job application form or a support ticket page can hand a stranger the ability to run code on your server — with no login at all.
On August 19, 2026, a critical flaw in Elementor Pro was patched and disclosed on the same day. The vulnerability, tracked as CVE-2026-32475, allows unauthenticated visitors to upload executable files through the plugin's Form widget and run them on the server. Elementor Pro powers more than 6 million WordPress sites (BleepingComputer, Sep 3, 2026), and Wordfence has blocked more than 190,000 exploit attempts since disclosure (Wordfence, Sep 2026). If your site uses Elementor Pro forms with file uploads, this is the update to prioritize and the one folder to check.
What happened
Elementor Pro is a drag-and-drop page builder for WordPress. Its Form widget includes a File Upload field — the kind businesses use for job applications, receipt uploads, or support screenshots.
The flaw sits in how that field validates uploads. The extension check and the file-move step run in two separate passes with different handling of empty file entries (Patchstack via The Hacker News, Aug 20, 2026). Wordfence traced it to a validation loop that exits instead of continuing when it hits an empty upload slot, which skips the file-type checks for everything submitted after it (Wordfence, Sep 2026).
An attacker exploits this by submitting two file parts for the same field: an empty file first, then a malicious PHP file second. The checker stops at the empty part and never inspects the PHP file. The mover skips the empty part and writes the PHP file to a public uploads directory. No login happens at any point. Requesting the uploaded file in a browser then runs the attacker's code — though the attacker first has to work out its random-looking filename. Researchers note this is easier than it sounds, since Elementor generates the name with PHP's time-based uniqid() function rather than a genuinely random one, making it crackable rather than a real barrier.
The timeline is short, and it involves two independent discoveries. Researcher Tin Pham (TF1T) reported the flaw to Patchstack on July 16, which alerted Elementor the same day; the vendor had acknowledged the report by July 17 (Patchstack via BleepingComputer, Aug 20, 2026). Separately, researcher Austin Ginder reported the same underlying bug to Wordfence around July 24 — no new CVE was issued, since it was the same flaw (it-connect.tech, Aug 2026). The fix shipped in Elementor Pro 4.2.2 on August 19, with the changelog describing it as improved code security enforcement in the Form widget. Attackers started probing sites the same day, with the heaviest activity between August 19 and 23 (Wordfence, Sep 2026). Wordfence published its active-exploitation alert on September 2, followed by BleepingComputer coverage on September 3. The CVE is rated CVSS 9.0 out of 10, Critical (NVD, CNA: Patchstack).
One important precision, because most coverage blurs it: having Elementor Pro installed alone is not enough to be attacked. The site needs a published page carrying an Elementor Form widget with a File Upload field (InstaWP; The Hacker News; BleepingComputer). Wordfence narrows it further to at least one non-required upload field — and the Required toggle is off by default, so most upload fields qualify. Common exposed setups include job applications, "attach a photo or receipt" flows, and support ticket forms.
Why this matters to website owners
For a shop owner, the uncomfortable part is how ordinary the entry point is. Nothing about the attack looks unusual to a customer. A visitor opens a careers page, attaches files, and submits. Behind the scenes, one of those files is a webshell — a small script that lets a stranger run commands on your server, read files, install backdoors, or send spam and phishing from your domain.
Three things make this pattern worse than a typical bug:
First, the blast radius is wide because the configuration is common. File uploads on public forms are everyday business, not an edge case. Plenty of Elementor Pro sites never touch the Forms module, but plenty do — and a site with no upload field today becomes exposed the moment someone adds one next month, without anyone touching the plugin (InstaWP).
Second, the compromise is quiet. There is no defaced homepage or failed checkout to alert you. The uploaded file sits in the forms upload folder with a random-looking name until the attacker uses it. The absence of symptoms does not mean the absence of a problem.
Third, the window between patch and exploitation has closed. Attackers probed within hours of disclosure. Sites that treat plugin updates as monthly maintenance are exposed for the exact period when attacks peak.
A smaller form plugin, Super Forms (CVE-2026-14894), saw the same pattern of unauthenticated upload abuse a few weeks earlier, patched in version 6.3.314 — another reason to inventory which of your plugins accept file uploads.
What to do
Update Elementor Pro to 4.2.2 or later. This is the fix. Dashboard → Updates in WordPress, or ask the person who maintains the site to apply it and confirm the version. The reason update comes first is that it closes the entry point — everything below is verification, not a substitute. Patchstack offers a firewall rule that blocks these attempts until the update is installed, and Wordfence's paid tiers (Premium, Care, Response) received a matching firewall rule as soon as the threat was confirmed. Free-version Wordfence users should note that new firewall rules typically reach them about 30 days after paid users, under Wordfence's standard release schedule — so a free installation should not be treated as covering this gap in the meantime. Either way, both vendors are clear that a firewall rule is a shield while the patch removes the hole (Patchstack; Wordfence, Sep 2026).
Check one folder for rogue PHP files. Look in /wp-content/uploads/elementor/forms/. That directory only stores form-submission uploads and should never contain PHP files, so the presence of any .php file there is a strong indicator of compromise (Wordfence; BleepingComputer, Sep 3, 2026). If you do not have server access, ask your host or developer to list that directory and report back. If a rogue file is found, treat it as an active incident: remove the file, assume the site may have backdoors, and get a focused security review rather than stopping at deletion.
Review access logs for the attack pattern. Ask your host or developer to search web server logs for requests to /wp-admin/admin-ajax.php with the action elementor_pro_forms_send_form, particularly from unfamiliar addresses. Wordfence's own advisory lists the specific IP addresses generating the most attack traffic — worth pulling directly from Wordfence's write-up rather than a static list here, since an active-attacker list shifts day to day. Matches confirm probing; the absence of matches does not guarantee the site is clean, because log retention and attacker rotation vary — which is why the folder check above matters more.
Limit what upload fields accept going forward. After patching, review every public form that takes files. Restrict allowed types to what the business actually needs (for example, PDF and images for applications), keep upload fields required only where the workflow demands it, and remove upload fields from pages that no longer need them. The reason is structural: every public upload endpoint is future attack surface, and the smallest set of accepted types leaves the least room for the next validation bug.
Key numbers
- 6M+ active installations of Elementor Pro — BleepingComputer, Sep 3, 2026; Wordfence, Sep 2026.
- CVSS 9.0 out of 10, Critical, CWE-434 unrestricted file upload — NVD (CNA: Patchstack). Wordfence rates the same flaw at 9.8; the CNA score is used here as primary.
- Affected: all versions through 4.2.1; fixed: 4.2.2, released Aug 19, 2026 — NVD; Patchstack timeline.
- 190,000+ exploit attempts blocked since disclosure, heaviest Aug 19–23, attacks starting the day of disclosure — Wordfence via BleepingComputer, Sep 3, 2026.
- Precondition: a published Elementor Form widget with at least one non-required File Upload field — Wordfence, Sep 2026.
- Compromise signal: any
.phpfile under/wp-content/uploads/elementor/forms/— Wordfence; BleepingComputer. - Researcher bounty of $15,600 paid to Austin Ginder (Anchor Hosting) through the Wordfence Bug Bounty Program; a second researcher, Tin Pham (TF1T), independently reported the same flaw to Patchstack — heise online; The Repository.
Final takeaway
A contact form is infrastructure that accepts files from strangers and stores them on your server. This flaw turned that everyday function into code execution — fixed in 4.2.2, exploited at scale within days. Update, check the one folder that should never hold executable files, and shrink the set of public upload points you maintain. That is an hour of work that converts your highest-blast-radius WordPress exposure this month into a verified non-event.
Is your site ready? Run a free security scan — 40+ automated checks, instant results, no commitment.