Patchstack has disclosed a critical flaw in Elementor Pro, one of the most widely used WordPress page builders, that lets unauthenticated attackers upload PHP files and achieve remote code execution.
The bug, tracked as CVE-2026-32475 with a CVSS score of 9.0, sits in the Forms module’s File Upload field. The extension check and the file-move step run in two separate loops that handle empty file entries differently.
Patchstack explains the gap: an attacker who posts two file parts for the same field sails past the extension blocklist and lands a PHP file in a public directory, with no login required.
All versions up to and including 4.2.1 are affected. The only precondition is that the target site publishes at least one Elementor page with a Form widget containing a File Upload field, a configuration Patchstack calls extremely common: job applications, photo and ID attachments, and support-ticket uploads all use it. The field’s required toggle defaults to off, so no unusual settings are needed.
Exploitation drops the file at wp-content/uploads/elementor/forms/ with a name derived from PHP’s uniqid() function. From there, an attacker can execute the uploaded script to take over the site.
Researcher Tin Pham, also known as TF1T, is credited with finding the flaw. Site owners should update Elementor Pro immediately, and defenders should review upload directories for unexpected PHP files.
