A Public Form Became an Unauthenticated Web Shell.
A critical Elementor Pro flaw can turn a public WordPress form into an unauthenticated file-upload path. A remote attacker needs no account, cookie or security nonce. If a vulnerable page exposes the right Form widget, the attacker can place executable PHP in a public uploads directory and potentially take control of the site.
The vulnerability, CVE-2026-32475, affects Elementor Pro 4.2.1 and earlier. Patchstack rates it critical, while NVD records a CVSS score of 9.0. Elementor released version 4.2.2 on 19 August 2026 with strengthened security enforcement in the Form widget.
The boundary failure is easy to underestimate because the vulnerable feature is ordinary website plumbing: a file-upload field inside a public form. The attacker does not need to compromise an administrator first. The form itself supplies the route into the server.
One empty file part changes the validation path
Patchstack’s analysis describes a mismatch between two loops in Elementor Pro’s upload handling. The validation loop stops when it encounters an empty first file part. A later processing loop does not stop in the same way. It continues to the next part and moves that file without applying the intended extension validation.
An attacker can therefore submit a multipart request in which the first upload is empty and the second contains a PHP payload. The malicious file is moved into wp-content/uploads/elementor/forms/, a location that is commonly reachable from the web. If the server executes PHP from that directory, requesting the uploaded file can produce remote code execution.
This is not a theoretical administrative misuse. Patchstack says no authentication, cookies or WordPress nonce are required. The practical prerequisite is a published Elementor page containing a Form widget with a File Upload field. Making the field optional, which is the default, leaves the empty-first-part technique available.
The public page exposes what the request needs
Elementor forms include identifiers and field names in the public page markup so a browser can submit the form correctly. Those values are not secrets, but they remove guesswork for an attacker. Patchstack’s research shows that the information needed to construct the malicious request can be collected from the public page.
The uploaded filename is based on PHP’s uniqid(). That does not make the payload safely unreachable. The value can be narrowed through request timing, and some form configurations may expose the uploaded path through an autoresponder email. Security cannot depend on an attacker failing to guess where an executable file was stored.
A verified scanner now reproduces the upload primitive
On 27 August, ProjectDiscovery added a verified Nuclei template for CVE-2026-32475. The template checks the Elementor Pro version, parses form identifiers from a public page, submits the multipart bypass and confirms that the server reports success.
The template uploads a harmless text marker rather than PHP. It is nevertheless an independent reproduction of the vulnerable file-handling path and materially lowers the effort required to test exposed sites. It is public proof-of-concept availability, not evidence of malicious exploitation. At the time of writing, the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalogue.
Affected, fixed and exposed conditions
| Question | Answer |
|---|---|
| Affected software | Elementor Pro 4.2.1 and earlier |
| Fixed version | Elementor Pro 4.2.2 or later |
| Authentication required | No |
| Site prerequisite | A public Elementor Form widget with a File Upload field |
| Potential impact | Arbitrary file upload and remote code execution where uploaded PHP is executable |
| Workaround | No vendor workaround was identified. Upgrade and remove unnecessary upload fields. |
| PoC status | A verified Nuclei template reproduces the upload bypass with a harmless text file |
| Exploitation status | No confirmed malicious exploitation identified in the cited sources |
What WordPress defenders should do now
- Upgrade Elementor Pro to 4.2.2 or later. Confirm the installed Pro version on every production, staging and recovery site.
- Inventory public forms with file uploads. Disable upload fields that are not operationally necessary, especially on anonymous-facing pages.
- Inspect the Elementor forms upload directory. Look for unexpected PHP, PHTML and other executable files in
wp-content/uploads/elementor/forms/. Preserve suspicious files and relevant access logs before removal. - Prevent script execution in upload paths. Configure the web server so user-writable directories cannot execute PHP or other server-side code. Treat this as defence in depth, not a substitute for upgrading.
- Review web and application logs. Hunt for unusual multipart form submissions, empty first file parts, repeated requests to Elementor forms and direct requests for recently created files under the forms directory.
- Assume site compromise if executable content is found. Rotate WordPress administrator credentials, database passwords, hosting credentials and API secrets after completing forensic preservation and scope analysis.
The BlackTree view
A form upload is a trust decision. The browser supplies a file, the application decides whether that file is acceptable, and the server decides what happens after it is stored. Here, a small control-flow mismatch can break the application decision and place an executable payload where the server may run it.
The absence of confirmed attacks should not be confused with a low-risk condition. The vulnerable component is widely used, the attack is unauthenticated, the required page values are public and a verified scanner now demonstrates the primitive. Those facts shorten the distance between disclosure and opportunistic scanning.
Patch first. Then inspect the upload directory and logs. An upgrade closes the path, but it does not answer whether someone used it before the site was fixed.
Sources
- Patchstack technical analysis, published 19 August 2026. The source provides no publication time.
- Elementor Pro changelog, version 4.2.2 released 19 August 2026. The source provides no publication time.
- NVD vulnerability record, published 19 August 2026 at 18:16:38 UTC.
- ProjectDiscovery Nuclei template commit, published 27 August 2026 at 06:08:21 UTC.
