Published on 4 September 2026
An unauthenticated attacker, a publicly accessible contact page with a file upload – and, in the end, complete control over your WordPress website: this is exactly the scenario made possible by a critical vulnerability in Elementor Pro, the widely used paid page builder for WordPress. The security firm Wordfence rates the flaw at the highest possible severity level and is urging site operators to act immediately. If you're running an older version and using a particular form field, read on now – and then update promptly.
Under the identifier CVE-2026-32475, a critical security vulnerability in Elementor Pro has been made public. Affected are all versions up to and including 4.2.1. The patched version 4.2.2 was released on 19 August 2026. Wordfence published its technical report on 20 August 2026, recommending an immediate update.
At the heart of the problem: a so-called arbitrary file upload vulnerability – in other words, a flaw that allows arbitrary files to be uploaded. Specifically, attackers can bypass the file validation of Elementor Pro forms and place executable PHP files onto the server. PHP is the programming language WordPress runs on; anyone who can sneak their own PHP file onto a server and execute it can essentially issue any command they like there.
Wordfence security researcher István Márton describes the outcome in no uncertain terms:
„This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site takeover.“ (István Márton, Wordfence)
Translated: unauthenticated attackers – meaning without any user account and without a password – can upload arbitrary files, including executable PHP files. This can lead to remote code execution (running malicious code remotely) and to the complete takeover of the website. It is precisely this combination – no login required, high potential damage – that makes the flaw so dangerous. Wordfence rates it with a CVSS score of 9.8, while the CNA Patchstack reported a score of 9.0 to the NVD database. Both values fall within the critical range (the scale goes up to 10).
The vulnerability lies in Elementor Pro's Forms module, more precisely in the file upload field. Patchstack describes the cause as follows:
„The flaw lives in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries.“ (Patchstack)
In simplified terms, here's what happens: Elementor checks uploaded files in a first loop (the Upload::validation() function) and later moves them to their storage location in a second loop (process_field()). However, both loops handle "empty" entries differently.
If a file upload field is not marked as required, the first entry in the upload can be empty (technically: UPLOAD_ERR_NO_FILE). In the validation loop, such an empty first entry causes the entire check to be aborted (with a return) instead of merely skipping that one entry (which a continue would do). The consequence: for all subsequent files in the same field, the check on the file extension and file type is dropped.
The second loop, by contrast, only skips the empty entry and dutifully moves the subsequent – now unchecked – file to its destination. The extension supplied by the attacker is preserved in the process. This is how a .php file ends up in the publicly accessible directory /wp-content/uploads/elementor/forms/. With the right server configuration, it can then simply be called up and executed via the browser.
The attack is carried out via the publicly accessible AJAX form (the technique by which forms send data to the server in the background) and, according to Wordfence and Patchstack, requires no authentication. The NVD database classifies the flaw under category CWE-434 – "unrestricted upload of file with dangerous type".
Wordfence estimates the reach of Elementor Pro at around 6,000,000 active installations. Important for context: this figure describes the plugin's potential spread – not the number of websites that are actually vulnerable, exposed, or even already compromised. The sources explicitly give no figure for websites or data records actually affected.
The flaw can only be exploited when two conditions coincide:
If this specific form configuration is absent, the described precondition for an attack is not met. You should nonetheless carry out the update, since otherwise the vulnerable program version remains installed.
Is the flaw already being actively exploited? As of 22 August 2026, the advisories reviewed contained no evidence of active exploitation and no functional public exploit. The KEV catalogue of the US agency CISA (a list of known exploited vulnerabilities) also contained no entry. This is explicitly not an all-clear, but merely the soundly formulated status of the sources. Since the technical barrier to entry is low and the potential damage is high, swift action remains essential.
wp-content/uploads/elementor/forms/ for unexpected files – especially those with the .php extension. Patchstack stresses: an update does not remove an upload that has already succeeded.wp-content/uploads/elementor/forms/ for unexpected files, especially .php. If you find anything, treat the website, credentials and server forensically – a plugin update alone does not remove a file that has already been placed.The vulnerability alone – and even a merely delayed update – is not automatically a reportable data breach. It becomes critical when attackers, via the compromised website, are able to view, alter, delete or exfiltrate personal data without authorisation. Since Elementor forms typically capture contact details, job applications or enquiries, this scenario is by no means far-fetched in the worst case.
Under Article 33 GDPR, the controller must report such a breach to the competent supervisory authority without delay and, where feasible, within 72 hours of becoming aware of it, provided the breach is likely to result in a risk to the rights and freedoms of natural persons. The German Federal Commissioner for Data Protection (BfDI) puts it like this:
„Jede Datenpanne, die die Rechte und Freiheiten natürlicher Personen bedroht, muss innerhalb von 72 Stunden an die zuständige Aufsichtsbehörde gemeldet werden.“ (BfDI)
Where a high risk is likely, Article 34 GDPR additionally requires the affected individuals to be notified without delay, unless a legal exception applies. Article 32 GDPR demands appropriate technical and organisational measures – which include the timely installation of security updates. For infringements of Articles 32 to 34, Article 83(4) GDPR sets an abstract maximum framework of up to €10 million or 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
This maximum framework is not a forecast of a fine. The specific individual case depends in particular on the types of data, the scope, the available evidence, the response and the measures taken. A directly comparable, officially published German fine decision relating to an unpatched WordPress plugin flaw is not substantiated in the sources reviewed.
This case fits into a broader trend. Across the entire WordPress ecosystem, Patchstack counted a total of 11,334 new vulnerabilities for 2025 – 42% more than in 2024. According to the same source, the number of highly exploitable vulnerabilities rose by 113%, and 46% of the vulnerabilities were not patched in time before public disclosure. These figures are overall statistics and do not relate specifically to Elementor Pro or CVE-2026-32475 – but they do show how important disciplined update management is for website operators.
How serious such upload flaws can become in practice is illustrated by a clearly separate comparison case from the past: for CVE-2023-5360 in the plugin "Royal Elementor Addons and Templates", Wordfence reported on 13 October 2023 on active exploitation and more than 46,169 attacks blocked within 30 days. That was a different plugin and a different CVE – it does not prove that CVE-2026-32475 is being actively exploited. It merely illustrates how quickly attackers can get going with disclosed file upload flaws once an opportunity presents itself.
CVE-2026-32475 is a critical vulnerability with a dangerous characteristic: it can be exploited without authentication and, in the worst case, can lead to the complete takeover of the website. The good news: there is a ready-made patch, and the conditions for an attack are tightly defined – affected are Elementor Pro up to 4.2.1 in combination with a published form containing an optional file upload field.
Act in this order: check the version, update to 4.2.2 or newer, review the forms and – if you were previously exposed – examine the upload directory for suspicious PHP files. Because while an update closes the door on new attacks, it does not remove a file that an attacker may already have placed. Anyone who follows these steps consistently and documents them not only minimises the technical risk but also fulfils their duties of care under Article 32 GDPR. For a task that takes just a few minutes, that's a very good trade.