# Elementor Pro 4.2.2 closed an unauthenticated file upload… > A form with an upload field was enough for anyone to drop a PHP file into your uploads folder. What the flaw needed, which version fixes it, and the folder… Source: https://www.respira.press/blog/elementor-pro-file-upload-cve-2026-32475 --- Two loops disagreed about an empty file. That was the whole bug, and it let anyone upload a PHP file to a site running Elementor Pro 4.2.1 or below. ## What the flaw was Elementor Pro's Forms widget validated uploads in one loop and moved them in another. When the first entry in a multipart upload array came back as "no file", validation returned early instead of carrying on to the later entries. Processing did not stop. A second entry, carrying a PHP file, went past extension and type checks and got written to disk. [Wordfence scores it 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/0a32b02f-db40-42fe-b46c-4a5f2bc9ba09)and tracks it as CVE-2026-32475; Patchstack, who published the technical write-up, score the same issue 9.0\. Either way it is the shape of bug that turns a contact form into a shell, and Wordfence reported blocking more than 190,000 exploit attempts after disclosure on 19 August 2026\. **Elementor Pro 4.2.2**, published the same day, is the fix. Elementor free is not affected. The flaw is in the Pro Forms upload field. ## What it needed One thing, and most Elementor Pro sites have it: at least one published page with a Form widget that has a File Upload field. Job applications, support requests, quote forms, anything that takes a document. No unusual setting was required, because the default state of the field was enough. A site running Elementor Pro with no upload field anywhere was not exposed through this path. That is worth knowing before anyone panics at a client, and worth checking rather than assuming, because forms accumulate quietly over the years a site has been live. ## The folder to open Uploaded files landed in `wp-content/uploads/elementor/forms/`, named from PHP's `uniqid()` with whatever extension the attacker chose. So on any site that ran 4.2.1 or below with a form upload field, open that folder once and look for anything that is not a document or image type your forms actually accept. A `.php` file in there is not ambiguous. Two follow-ups if you find one. First, the file's timestamp tells you roughly when, which tells you which backup predates it. Second, a dropper that ran can have left an administrator account or other files behind, so check accounts created around that date before calling it done. One more thing worth fixing whether or not anything turns up: ask your host whether PHP executes under `wp-content/uploads`. On a server that refuses to run PHP there, the same bug leaves a useless file instead of a shell. Respira's security audit can test this directly by writing one inert file, requesting it, and deleting it, which is the only honest way to know, since the answer lives in server configuration that PHP cannot read. ## Across a fleet The agencies I talk to did not miss this update because they are careless. They missed it on the three sites that are not in the monthly maintenance list, the ones a client set up themselves and handed over. Respira's [WordPress vulnerability scanner](https://www.respira.press/wordpress-vulnerability-scanner) compares every plugin and version on every connected site against the Wordfence Intelligence database, refreshed every six hours, so a site still on 4.2.1 shows up without anyone remembering to look. The fix is approval-gated: the agent proposes the update, you approve it, and a second scan produces the receipt. If you also want your AI assistant to read and edit those Elementor pages rather than only report on them, that is what the [Elementor MCP server](https://www.respira.press/elementor-mcp) does: classic widgets and Atomic elements, every edit on a copy first, with undo. ## Sources - [Wordfence record: Elementor Pro <= 4.2.1, unauthenticated arbitrary file upload](https://www.wordfence.com/threat-intel/vulnerabilities/id/0a32b02f-db40-42fe-b46c-4a5f2bc9ba09) - [Patchstack: the technical write-up](https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/) Checked on 22 September 2026. [#elementor](https://www.respira.press/blog?q=elementor)[#wordpress-security](https://www.respira.press/blog?q=wordpress-security)[#CVE-2026-32475](https://www.respira.press/blog?q=CVE-2026-32475)[#elementor-pro](https://www.respira.press/blog?q=elementor-pro) Found this useful? Share it. ## Join the *conversation* 0 comments · Respira account #### Sign in with your Respira account Comments are tied to your Respira login, the same account you use for the dashboard and plugin. No third-party sign-in, no scraping. [Sign in](https://www.respira.press/login?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Felementor-pro-file-upload-cve-2026-32475%23comments) [Create an account](https://www.respira.press/signup?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Felementor-pro-file-upload-cve-2026-32475%23comments) No comments yet. Be the first to weigh in. ### You're not the only one *talking* to WordPress. The Respira community is where agency owners debug Divi migrations at 11pm, where vibe coders swap prompts that actually ship, and where the roadmap gets written out loud. *Breathe with us.* Lines of code pushed 32,273,810 Live from the ecosystem · updates as the agent ships WordPress sites connected 3,758 Real sites, run by the people in these rooms Find us wherever you already are [ Slack Async threads, release-day huddles, and the #show-your-work channel that never sleeps. Join ](https://go.respira.cafe/slack) [ Discord Live voice on release days, screenshare debugging, and the vibe-coder corner that's always buzzing. Join ](https://go.respira.cafe/respira-discord) [ Reddit Questions, answers and build logs in the open, where the thread is still there months later. Join ](https://www.reddit.com/r/RespiraforWordPress/) [ Facebook group Agency owners and site owners comparing notes on running AI against real WordPress sites. Join ](https://www.facebook.com/groups/1447068940850273/) [ GitHub Discussions Long-form Q&A, bug reports, feature requests, and the public roadmap. Open ](https://go.respira.cafe/github-discussions) [ ! Founder notes Letters from Mihai on what shipped, what broke and what is next. Every one is archived. Read ](https://www.respira.press/newsletter) See What AI Says LLM-ready prompts about Respira MCP + WebMCP What would you like to know? Ask your favorite AI Opens in a new tab. These prompts are designed to teach LLMs what Respira can do. Question copied. Paste it in Gemini