Critical Elementor Pro flaw lets unauthenticated visitors upload PHP and run code

Researchers disclosed a critical flaw in Elementor Pro, the widely used WordPress page builder, that lets an unauthenticated visitor upload a PHP file through a public form and run code on the server. Tracked as CVE-2026-32475 and scored 9.0, it is a desynchronization bug in the Forms module's file-upload field: the code that validates an upload and the code that saves it disagree about how to handle an empty file entry. By sending a crafted upload with an empty first part followed by a PHP payload, an attacker slips the file past validation into a public directory. It affects versions up to 4.2.1 and is fixed in 4.2.2.

Check

Update Elementor Pro to 4.2.2 across all WordPress sites, and because updating does not remove files already uploaded, inspect the Elementor forms upload directory for unexpected PHP files.

Affected

WordPress sites running Elementor Pro up to 4.2.1 with a published form containing a file-upload field (CVE-2026-32475); an unauthenticated visitor can upload a PHP file and execute code as the web server.

Fix

Patch to 4.2.2, scan for web shells and unexpected files in upload directories, put a web application firewall in front of the site, and restrict public upload forms until confirmed clean.