Elementor Pro form upload flaw exploited: update to 4.2.2 or later

On August 19, 2026, Elementor released Elementor Pro 4.2.2 to fix a critical flaw in its Form widget (CVE-2026-32475). On sites with a public form that has a file upload field, an attacker without an account could upload a PHP file and run it, which means full control of the site. Wordfence estimates Elementor Pro runs on about 6 million sites.

According to Wordfence, as reported by BleepingComputer, attacks began on the day the patch shipped. Its firewall blocked more than 190,000 attempts between August 19 and 23 alone.

If your site has updated since then, you are most likely already protected, but check the version. Updating closes the hole but does not remove a file that was uploaded before.

Who is affected

• Sites running Elementor Pro 4.2.1 or earlier.
• The attack needs a published page with an Elementor Pro Form that includes a File Upload field. The free Elementor plugin on its own is not the subject of this alert.

How to check your site

1. In WordPress, open Plugins and find Elementor Pro. The version number appears under its name.
2. If it shows 4.2.1 or lower, the site was exposed.
3. Think about whether any of your forms let visitors attach a file (a CV, a photo, a quote request). If yes, the risk was real.
4. Ask your host or developer to look in the folder wp-content/uploads/elementor/forms/ for any file ending in .php. That folder should never contain PHP files.

What to do now

1. Update Elementor Pro to 4.2.2 or later from the Plugins page.
2. If a PHP file is found in the forms upload folder, treat the site as compromised: have it cleaned by your host or a security professional, then change all passwords.
3. Check Users for administrators you do not recognise.

This alert reports what the sources listed below published and is not a guarantee about any specific site.