Elementor Pro CVE-2026-32475: exposed with no upload field?

CVE-2026-32475 is an unauthenticated file upload flaw in Elementor Pro versions up to 4.2.1. Patchstack says it needs a published form with a File Upload field that is not set to required. The CVE record names 4.2.2 as the fix. Update, then look for .php files in wp-content/uploads/elementor/forms/. Updating does not remove anything planted earlier.

Who is affected, and what if my form has no upload field?

You need Elementor Pro, the paid plugin that adds the Form widget. Free Elementor alone is not named in the CVE record. The CVE record lists Elementor Pro through 4.2.1 as affected.

The condition is narrower than "every Elementor Pro site". Patchstack says the way in is a published page with a Form widget that has a File Upload field whose Required toggle is off. Patchstack says that is the default state, so no unusual setting is needed. A contact form with only name, email and message is not the form Patchstack describes.

Three cautions before you relax:

• Forms live in many places. Popups, templates, landing pages and old drafts that were published can carry a form you forgot. Search your pages for the File Upload field type, not just the contact page.
• A form can change. Someone adds a CV upload next month on an unpatched version and the condition is met.
• We found no source that proves a site without an upload field cannot be reached. Patchstack and Wordfence describe the upload field as the entry point. That is a description of the bug, not a guarantee about your site. Update either way.

Which Elementor version am I on, and what does the changelog say?

Elementor sells a free plugin and a paid Pro plugin, and the two are easy to mix up. The CVE is about Pro only. In your dashboard, open Plugins and read the version under the entry called Elementor Pro. Do not read it from the free Elementor entry.

We cannot tell you why the dates differ. The changelog page also does not label each entry as Core or Pro, so we do not state a "latest Elementor Pro version" on this page. Its top entry at our check was 4.3.5, dated 2026-10-13. Whatever the cause, the rule is the same: 4.2.2 or later is the fixed range, and your installed version decides it, not a date.

How do I fix it?

The fix is the plugin update. The CVE record gives the vendor solution as updating to at least 4.2.2.

How do I fix it if I manage the WordPress site myself?

• Open Plugins in your dashboard and read the Elementor Pro version. Anything at 4.2.1 or below is in the affected range.
• Update Elementor Pro to 4.2.2 or later. Take a backup first if the site takes orders.
• Find every form with a File Upload field and decide whether it needs one. Remove it from forms that do not.
• Open wp-content/uploads/elementor/forms/ through your host's file manager or SFTP and look for any .php file. See the section on what to look for below.
• If you cannot update yet, ask your host whether a firewall rule is in place. Patchstack says it issued mitigation rules for its customers. A rule is a stopgap, and the update is the fix.

How do I fix it if a host or agency runs the site?

Send this and keep the reply:

For [your domain]: which Elementor Pro version is installed, and was it updated to 4.2.2 or later? On what date? Please also check wp-content/uploads/elementor/forms/ for .php files and tell me what you found, with the date of the check.

Managed WordPress hosts sometimes update plugins automatically and sometimes do not; how the big managed hosts handle plugin patching is compared on its own page. Ask, and keep the answer. For other October incidents that need a host question, see the tracker.

Am I affected? A three-state self-test

Was anything exploited, and what should I look for?

Attacks were reported. Wordfence reports active exploitation of this flaw. BleepingComputer and Web Hosting Today report Wordfence's figures: attempts from 19 August 2026, the day of disclosure, and more than 190,000 blocked attempts, mostly between 19 and 23 August. Those are the vendor's own telemetry for its firewall. They count blocked requests, not compromised sites, and we found no source that counts compromised sites.

Dates differ between sources on one point. The CVE record carried a CISA ADP entry reading "Exploitation: none" when it was last updated on 20 August 2026, which was before Wordfence's report. We did not find CVE-2026-32475 in the first page of the CISA KEV catalog at our check on 24 October 2026, and we do not claim it is absent.

Any site that ran a vulnerable version with a public upload form should be checked, whatever the date. What to look for:

Patchstack says to review that folder for anything that is not a document or image type, in particular files ending in .php, because an update does not remove a file an attacker already placed there. If you find one, do not just delete it and move on. Get your host or a WordPress incident responder involved, and read the signs of a compromised site. After any hit, also look for a hidden WordPress admin account.

Whether an uploaded PHP file runs depends on the server configuration, for example whether execution is blocked in the uploads directory. You cannot assume either way. That is why this class of bug matters, and why the PHP2Shell bug is a separate problem: patching Elementor does nothing for the PHP engine underneath it.

What is the bug, without the exploit?

Patchstack describes a mismatch in how the Form module's upload handling treats empty file entries. The check that blocks dangerous extensions and the step that saves the file do not agree on what counts as an entry. A crafted submission can get a file past the check. The result is a file written to a public folder, which on a PHP site can mean code running on the server. We do not reproduce request details, and you do not need them to fix your site.

Timeline from Patchstack: report received 16 July 2026, patch prepared the next day, patch reviewed by Patchstack on 3 August, patch released and advisory published 19 August 2026. The CVE record credits Tin Pham (TF1T) of VietSunshine Cyber Security Services.

How do I keep other form plugins in check?

Upload fields on public forms are a repeat source of trouble across WordPress form plugins. The form builder plugin risk tracker lists the others. If a form does not need to accept files, removing the upload field removes that entry point whatever the plugin version. Bricksforge had a similar upload flaw in a page builder add-on, and the other WordPress guides cover more plugins. Once you have patched, hardening steps for the files and users are the next job.

What can a free scan tell me here?

The free scan identifies the technologies your site serves and matches each version to known vulnerabilities. It is a lookup: it can say a version is affected, not whether your setup is exposed. It does not check your form fields or your uploads folder.