If your agency, e-commerce shop or marketing site runs on WordPress with Elementor Pro, and somewhere on it there’s a form with a file upload field (a job application page, a support ticket form, a portfolio submission form, anything), a vulnerability patched three weeks ago deserves a version check today.
How a “safe” file upload became remote code execution
CVE-2026-32475 sits in Elementor Pro’s File Upload form widget, which validates file extensions in one code loop and then handles the actual save in a separate one. Under normal conditions, the plugin checks an uploaded file’s extension against an allowlist and rejects dangerous ones like .php, .phtml and .asp. The two loops don’t agree on how to treat an upload with an empty filename, and that mismatch lets an attacker slip a PHP file past the filter entirely.
The uploaded file is then saved to a public directory using a filename generated by PHP’s uniqid() function. That function looks random but is actually based on the current timestamp, which means an attacker who knows roughly when they uploaded their file can predict or brute-force its filename, request it directly, and have the server execute it as PHP. From a public form field to running arbitrary code on your server, with no login required. Patchstack rated it 9.0, Wordfence rated it 9.8, and either way it’s about as bad as a WordPress plugin vulnerability gets.
Already under active attack
Researcher Tin Pham reported the flaw to Patchstack on July 16, Elementor shipped the fix in version 4.2.2 alongside the public disclosure on August 19, and Wordfence’s firewall has already logged over 190,000 blocked exploitation attempts. Elementor Pro runs on an estimated 6 million WordPress sites, and Elementor itself is disproportionately popular with European agencies and small businesses building on WordPress rather than a custom stack, which makes this a continent-wide exposure, not a niche one.
What to check now
Confirm Elementor Pro is on 4.2.2 or later. If you can’t update immediately, remove or disable any form using the File Upload field until you can. Either way, check your uploads directory for unfamiliar .php files and review server logs for POST requests to form submission endpoints you don’t recognise, since a compromise here doesn’t necessarily announce itself with a defaced homepage, sometimes it’s a quiet backdoor left for later.
If you manage a WordPress site and aren’t confident your plugins, themes and forms are locked down against this kind of flaw, contact Excello Digital. We help European businesses keep their web presence patched and defensible instead of finding out about a vulnerability from an attacker.