A critical Elementor Pro RCE vulnerability has been patched in version 4.2.2, released on 19 August 2026, closing a flaw that could allow an unauthenticated attacker to upload and execute arbitrary PHP files on a victim’s web server. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0, according to Cyber Kendra.
What makes the timeline here worth examining: the Elementor team had a working fix prepared on 17 July, just one day after receiving the disclosure. The patch did not reach users until 19 August, a gap of 34 days between fix and release, as Cyber Kendra notes. Administrators running Elementor Pro below 4.2.2 should treat updating as urgent.
How the Elementor Pro RCE vulnerability works
The bug lives in the plugin’s File Upload module, which uses two separate loops for file validation and for file processing. Those two loops handle empty filename uploads differently, and that disagreement is the crack an attacker can wedge open.
Patchstack, a cybersecurity company focused on the WordPress ecosystem, reported the mechanics plainly: ‘The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.’
In practice, an attacker crafts a multipart upload in which the first entry carries a blank filename, followed by a malicious PHP payload. The validation routine encounters the empty entry, registers an UPLOAD_ERR_NO_FILE error, and exits without ever inspecting the second part. The processing step, however, simply skips the blank entry and moves the PHP file in the second part into the public directory wp-content/uploads/elementor/forms/.
Once the file is in place, the attacker needs to know its URL. Filenames are generated using PHP’s uniqid() function, which is time-based rather than random. Patchstack notes that an attacker can determine the filename through a timing brute-force, and in certain configurations may obtain its exact URL via an autoresponder email. A single HTTP request to that URL is enough to trigger execution, with the PHP interpreter running the payload at web-server privilege level.
Who is actually at risk
The scope is narrower than the severity score might suggest. Elementor itself has told subscribers the vulnerability affects only ‘websites that use an Elementor Pro Form with an upload file form field, and the multiple file upload option enabled (it is disabled by default).’ Sites without a published Elementor form containing a File Upload field are not exposed to this particular attack path.
That said, Elementor is the paid tier of a drag-and-drop website builder for WordPress with more than 10 million active installs. The Pro version layers on form creation, theme and popup builders, custom code and CSS, and e-commerce tooling, so its user base skews towards higher-traffic, higher-value targets. Elementor’s own advice is for all Pro users to update regardless: ‘Every other Elementor site is unaffected, however we still recommend all sites update to the latest version to reduce the likelihood of security and incompatibility issues.’
The researcher who found the flaw is Tin Pham, also known by the handle TF1T, who reported it to Patchstack on 16 July. According to Rankiteo, the fixed version 4.2.2 landed on 19 August 2026. Patchstack verified the fix on 3 August before the release went live.
No active exploitation in the wild has been observed at the time of writing. That may not last: the vulnerability details are now public, the affected directory path is known, and the brute-force timing window for filename discovery is a well-understood technique. Patchstack adds a point administrators should not overlook: updating Elementor Pro does not remove any malicious files already uploaded during the exposure window. A manual inspection of wp-content/uploads/elementor/forms/ for unexpected PHP or executable files is strongly recommended for any site that ran a vulnerable version with file upload forms enabled.
