Elementor Pro, the premium page-builder extension used on an estimated 6 million WordPress sites, had a critical security flaw that let attackers take over a site without ever logging in. Wordfence and Patchstack both disclosed the vulnerability, tracked as CVE-2026-32475 with a severity score of 9.0 out of 10.
What happened
The flaw lived in the Forms widget’s File Upload field. Elementor Pro checked uploaded files for dangerous extensions and moved accepted files into a public folder using two separate steps, and those two steps handled empty file entries differently. According to Patchstack’s writeup, an attacker could submit two file parts for the same upload field. That mismatch let a PHP file skip the extension check entirely and land in a public directory, where visiting it in a browser would run it. That’s a direct path to full remote code execution and site takeover.
Who is affected
You’re at risk if your site runs Elementor Pro and has a published page containing a Forms widget with at least one File Upload field that isn’t marked as required. The attack doesn’t require an account or login of any kind.
Security researcher Austin Ginder reported the flaw through the Wordfence Bug Bounty Program on July 24, 2026, and earned a $15,600 bounty for the find.
What to do
Update Elementor Pro to version 4.2.2 or later. Patchstack says the fix closes the gap between the two validation steps and adds a second extension check right before a file is moved into place, so the blocklist can no longer be bypassed.
If you run Wordfence, its firewall’s built-in Malicious File Upload protection already blocks exploitation attempts against this flaw, including on the free version. That protection buys you time, but it isn’t a substitute for updating the plugin.
End of article