Elementor Pro CVE-2026-32475: how to check your website

On 19 August 2026 Elementor released Elementor Pro 4.2.2. It closes a hole in the form widget: on a form with a file upload field, anyone could upload a PHP file and have the server run it, without logging in. Attacks started the same day. This note explains who is affected, how to check your site, and what to do if a file got through. Updated 26 October 2026.

What is the hole?#

CVE-2026-32475, rated 9.8 out of 10. Elementor Pro checks the type of a file before it saves an upload, but the check could be sidestepped by sending the field's files in a shape it did not expect. A .php file then went through as if it were a PDF or a photo.

The file is saved in wp-content/uploads/elementor/forms/ under a random name, and most web servers will run a PHP file there when someone asks for it. From that point an attacker can do whatever the site can: read the database, create an admin user, send spam from your domain, or leave more files behind for later.

Update 3 September: Wordfence reports blocking nearly 190,000 attempts between 19 and 23 August, and almost 200,000 since the fix. The attacks are automated. Nobody has to know your site exists; a script finds the form.

Does it concern my website?#

Elementor Pro 4.2.1 or older: yes. Update.
Only the free Elementor: no. The form widget is part of Pro, and so is the hole.
Pro, but no form with a file field: the hole cannot be reached today, but update anyway. Someone adds an upload field to the job page next year, and nobody remembers this note.

The forms that matter are the ones that take files: job applications with a CV, quote requests with photos or drawings, complaints with a receipt. On small Danish business sites they are common.

How do I see which version I have?#

In WordPress: Plugins → Installed plugins → Elementor Pro. The version is under the name.
From outside: Elementor Pro usually loads its files with the version in the address, like …/elementor-pro/assets/…?ver=4.2.1. The free website check reads it and says when it is below 4.2.2.

A caching plugin or a CDN can keep serving the old address for a while after an update, so trust the Plugins page over the website.

How to update#

Take a backup of files and database. Most hosts have a button for it.
Update Elementor (the free plugin) first, then Elementor Pro to 4.2.2 or newer. Pro needs the free plugin, and an old free version can break a new Pro.
Send each form with a file attached and check that it arrives.

Pro updates only arrive while the licence is active. If WordPress shows no update for Elementor Pro, the licence has probably lapsed, or it sits on the account of the agency that built the site. Both are fixable, but nothing updates until they are.

Look in the upload folder#

Open wp-content/uploads/elementor/forms/ with your host's file manager or over SFTP. You should find what visitors sent: PDFs, JPGs, Word files. A file ending in .php, .phtml or .phar does not belong there. The fix stops new ones, but it does not remove anything that arrived before.

On Apache hosts, which is most Danish web hotels, a .htaccess file in wp-content/uploads with these lines stops PHP from running in the folder at all:

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

On nginx, ask the host to block PHP under /wp-content/uploads/. Many already do.

If you find a PHP file there#

Do not just delete it. It may already have run, and the first thing such a file usually does is leave a second way in. Treat the site as compromised:

Restore a backup from before the file appeared (the file date tells you roughly when), then update before the site goes back online.
If there is no clean backup: look for admin users you do not know (Users, sorted by date), plugins you did not install, and recently changed files in wp-content.
Change the passwords for WordPress admins, the hosting account, the database and SFTP, and the keys the site holds: email sending, payment, any API.
Tell your host. They can see in their logs what the file did.

Why some sites are still open#

The fix has been out since August, and plenty of sites still run 4.2.1 or older. It is rarely laziness. Pro is a paid plugin and does not update without a licence, auto-updates for plugins are off by default, and the person who set up the site moved on. If that sounds like yours, I wrote about taking over a WordPress site from a previous agency, and the WordPress page says what I do with sites like that.

Sources#

I will update this note if the fixed version or the reports of attacks change.