CVE-2026-32475 (CVSS 9.8): Elementor Pro Flaw Risks Complete Site Compromise for 6 Million Sites
Do Son 
TL;DR
CVE-2026-32475 is a CVSS 9.8 unauthenticated arbitrary file upload flaw in Elementor Pro. It affects an estimated 6 million WordPress sites running versions up to 4.2.1. Successful exploitation can lead to remote code execution and complete site compromise. No exploitation in the wild has been confirmed at the time of writing.
- CVE: CVE-2026-32475
- CVSS: 9.0 (Critical · CVSSv3)
- Product: Elementor Pro
- Affected: n/a
- Impact: WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
- Status: No confirmed exploitation yet
- Patched in: 4.2.2
- EPSS: 0.4% (30-day)
- Action: Update to 4.2.2 now
Why CVE-2026-32475 Matters
Elementor Pro is one of the most popular premium WordPress page builders. Wordfence estimates around 6 million active installations. As a result, the blast radius is huge. The flaw needs no login at all. An unauthenticated attacker can upload a PHP file and run it. That path leads straight to complete site compromise. Wordfence details the issue in its official advisory.
A Note on Severity Scores
Sources differ slightly on the rating. Wordfence scores the bug at CVSS 9.8. Patchstack, which coordinated a separate disclosure, lists CVSS 9.0. Both agree the flaw is critical and enables unauthenticated RCE.
How the Attack Works
The bug lives in the Forms module’s File Upload field. Two routines handle uploads. One validates files, and one processes them. However, they disagree on how to treat an empty upload slot.
The validation routine hits an empty first entry and returns early. Therefore it skips all extension and file-type checks for the rest of that field. The processing routine, by contrast, uses continue and moves on. So it still saves the second, unchecked file.
An attacker sends two parts in one upload field. The first part is empty and triggers the early exit. The second part carries a PHP file with an attacker-chosen extension. Because the extension comes straight from the filename, the server writes a live PHP file to a public uploads folder. The attacker can then request that file to run code.
What Triggers Exposure
Installing the plugin alone is not enough. The site must publish a page with an Elementor Pro Form widget. That form needs at least one File Upload field marked as not required.
Exploitation Status
No public source confirms active exploitation yet. Researcher Austin Ginder reported the flaw through the Wordfence Bug Bounty Program. He earned a bounty of 15,600 US dollars. Because the mechanism is now public, defenders should expect exploit attempts soon.
Affected Versions
The flaw affects all Elementor Pro versions up to and including 4.2.1. Version 4.2.2 contains the fix. The vendor released it in August 2026.
Patch and Mitigation Steps
Update Elementor Pro to version 4.2.2 or later right away. If you cannot patch at once, review your published forms. Remove or disable any non-required File Upload fields as a stopgap. After patching, scan the uploads directory for unexpected PHP files. Watch for signs of webshells or other tampering.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
