One Empty File to Full Takeover: Elementor Pro Under Active Attack

Summary

A critical flaw in Elementor Pro, one of the most widely deployed WordPress page builders with more than 10 million active installations, is being exploited in the wild to seize complete control of vulnerable websites. Tracked as CVE-2026-32475, the vulnerability lets an attacker upload an executable PHP file through a plugin feature as ordinary as a contact or job-application form. Once that file is on the server and requested through the browser, it runs as code, handing the attacker a foothold from which they can steal data, deface the site, or plant a persistent payload. Because the flaw sits in the Forms module’s File Upload field, any site running a published form that accepts attachments is a candidate target, and that is an extremely common setup.

Vulnerability Details

Finding #1

CVE-2026-32475 is a critical unauthenticated arbitrary file upload vulnerability in the Forms module of Elementor Pro. It affects every version of the plugin up to and including 4.2.1. The weakness lives in the File Upload form field, the everyday feature that lets site visitors attach a document, photo, or resume when they submit a contact, support, or job-application form, and it turns that harmless-looking field into a path for running attacker-supplied code on the server.

Finding #2

At the heart of the flaw is a disagreement between two pieces of the plugin’s own code. When a form is submitted, one routine checks each uploaded file’s extension against a blocklist that bans PHP and other executable types, while a second routine moves the accepted files into a public folder. The two disagree on how to handle an empty upload slot: the checker stops entirely the moment it hits one, whereas the mover only skips it and keeps going. An attacker abuses this by sending two file parts under the same field, an empty one first and a PHP payload second, so the validator quits before ever inspecting the payload while the mover writes it into a web-accessible directory.

Finding #3

Exploitation needs no authentication and no user interaction. The request goes to the plugin’s public form-submission endpoint with no login cookie or security token, and the only prerequisite is a published Elementor form with a File Upload field, a common configuration rather than an exotic one. The file lands in the public forms directory under a randomized name generated from PHP’s time-based uniqid() function; because that name is not returned in the response, the attacker recovers it by brute-forcing the narrow time window using the server’s own Date header, or simply reads it from the submission-notification email where one is enabled.

Finding #4

The vendor released a fix in Elementor Pro 4.2.2 on August 19, 2026, which brings the two routines into agreement and re-checks the extension immediately before the file is moved. Notably, active exploitation began the very same day the patch shipped, as attackers reverse-engineered the fix rather than discovering it beforehand. Wordfence reported blocking well over 190,000 exploitation attempts in the days that followed, with attackers deploying web shells to take over sites.

Vulnerability & CPE Reference

Recommendations

MITRE ATT&CK TTPs

Indicators of Compromise (IoCs)

References & Patch Links

• https://wordpress.org/plugins/elementor/
• https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/
• https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/?_s_id=cve