Elementor Pro: Critical Vulnerability CVE-2026-32475 - Update Immediately

If you have Elementor Pro installed on your website, act immediately: the elementor pro vulnerability tracked as CVE-2026-32475 with a CVSS score of 9 allows an attacker with no authentication to upload arbitrary files including PHP scripts to the server and execute them as remote code. Since 7 September 2026 this vulnerability is being actively exploited and the Wordfence team blocked more than 190,000 attack attempts up to that date. The fix has been available since 19 August 2026 in the form of Elementor Pro 4.2.2. If you have not updated yet, your website is under active attack right now.

What is CVE-2026-32475 and why is it critical

CVE-2026-32475 is a critical unauthenticated arbitrary file upload vulnerability in Elementor Pro version 4.2.1 and earlier. An attacker with no login or special permissions can upload a PHP file to the server and execute it via a URL as remote code (Remote Code Execution, RCE). The CVSS score of 9 reflects the full impact: the attacker gains complete control over the server, access to the database and customer data, and can deploy malware across all website pages or recruit the server into a botnet.

According to the security team at Patchstack, the root of the flaw is insufficient MIME type validation when uploading files through Elementor Pro forms and the Upload widget. The plugin only checked the file extension on the client side, not the actual file content on the server side. An attacker renames a PHP script with a .php extension to .png - Elementor Pro accepts and stores it in wp-content/uploads/, and a second HTTP request executes it as PHP code with full web server permissions.

Why is this particularly serious? Because from the time a new vulnerability is registered in the CVE database to the first automated attacks, hours pass - not days. Automated scanners continuously sweep the internet comparing installed plugin versions against vulnerability databases. Any website running Elementor Pro 4.2.1 or earlier has been an active target since 7 September 2026.

Who is affected by the elementor pro vulnerability

The vulnerability affects every website running Elementor Pro version 4.2.1 or earlier. The free Elementor plugin is installed on more than 5 million websites according to Patchstack, while Elementor Pro is the premium paid add-on used by a subset of those sites. If you see Elementor Pro in your WordPress plugin list with a version lower than 4.2.2, your website is at risk.

The risk is particularly high for websites that match any of the following:

• Forms and upload widgets built with Elementor Pro: The vulnerability is triggered through the form widget or Upload widget. Sites with login forms, contact forms, or file upload sections are directly exposed to attack without any further precondition.
• Shared hosting: One compromised site on a shared server can endanger other sites on the same server through access to shared directories or configuration files.
• Disabled or delayed updates: Sites where the administrator postpones updates or has them fully disabled remain vulnerable the longest and are the most common targets for automated scanners.
• No web application firewall: Sites without active network-level protection (WAF) cannot block PHP file upload attempts even when an attacker correctly configures the exploit.

Elementor Pro is popular among web agencies and freelancers who use it for advanced layouts and form functionality. WordPress site security is not just a concern for large portals and e-shops - even a small business website is a valuable target as a botnet node, a source of customer email addresses, or a platform to distribute malware to visitors.

How to fix the Elementor Pro vulnerability step by step

The fix is straightforward: update Elementor Pro to version 4.2.2 or higher. Version 4.2.2 was released on 19 August 2026 and contains a complete patch according to the Wordfence August advisory. Even if you have automatic updates enabled for premium plugins, confirm in Plugins > Installed Plugins that the version is indeed 4.2.2 or higher - automation can fail for licensed premium plugins if the license has expired.

1. Backup before updating (mandatory): Always back up your database and files before any update. If you are unsure how, follow our guide to WordPress backup using the 3-2-1 strategy.
2. Staging test for production sites: If you run an e-shop or a site with sensitive data, update on a test environment first. Find the detailed procedure in WordPress updates via staging and rollback.
3. Update in the admin panel: Log in to wp-admin > Plugins > Installed Plugins, find the Elementor Pro row and click Update Now. Alternatively go to Dashboard > Updates.
4. Verify the version: After updating, confirm that the version shown for Elementor Pro is 4.2.2 or higher.
5. Functional test: Go through key pages with forms and widgets and verify that everything works correctly.

If the site breaks after the update, you will find the most common causes and solutions in this guide for when a WordPress site stops working after an update. In most cases the issue is a plugin conflict and is resolved by deactivating the conflicting plugin.

How to check whether your site has been compromised

If you had Elementor Pro version 4.2.1 or earlier installed and did not update immediately after the patch was released in August, there is a real risk of compromise. According to the Wordfence September advisory, attacks have been active since 7 September 2026 and their intensity is growing. The verification procedure involves five steps:

• Check upload directories for PHP files: Use FTP or your hosting provider's file manager to check the wp-content/uploads/ directory and all subdirectories. No .php files should be present there - their presence is clear proof of compromise and the site should be taken offline immediately.
• Full site scan with a security plugin: If you have Wordfence installed, run a complete scan (Wordfence > Scan > Start New Scan). The plugin compares all files against original values and highlights changed or unknown files.
• Server log analysis: Ask your hosting provider for access logs. Look for POST requests targeting wp-content/uploads/ or GET requests to unknown .php files in that directory.
• Change credentials: Immediately change the passwords of all WordPress administrators and regenerate WordPress Security Keys in your wp-config.php file.
• Check for new administrator accounts: Review Users > All Users for any unknown accounts with the Administrator role.

If you find PHP files in upload directories or other signs of compromise, we recommend contacting a security specialist. A compromised site can continue spreading malware even after visible malicious files are removed - attackers typically install multiple backup backdoors and hidden administrator accounts.

Preventive security measures for WordPress sites

Updating Elementor Pro is the immediate fix, but systemic security requires more than a one-off patch. Critical vulnerabilities in popular plugins appear several times a year and each is a potential entry point. Our comprehensive guide to WordPress site security in 2026 covers the full set of recommended measures. Here are the five with the highest impact:

Measure	Priority	Implementation time
Automatic plugin updates (at least security patches)	High	5 minutes
Block PHP execution in wp-content/uploads/ via .htaccess	High	10 minutes
Web Application Firewall (Wordfence or Cloudflare WAF)	High	30 minutes
Regular backups to external storage following the 3-2-1 rule	Medium	15 minutes
File integrity monitoring and uptime monitoring	Medium	20 minutes

Blocking PHP execution in wp-content/uploads/ via an .htaccess rule is part of the standard setup for every managed WordPress site we work with. This single configuration change would have prevented the RCE attack in the case of CVE-2026-32475 even if the attacker succeeded in uploading the PHP file - the server would have stored it but blocked its execution at the web server level.

For long-term and systematic security management, we also recommend reading our complete guide to WordPress site management in 2026, which covers the full security cycle including monthly update routines and monitoring.

Conclusion

The Elementor Pro vulnerability CVE-2026-32475 is one of the most serious WordPress security incidents of 2026. A critical CVSS score of 9, confirmed active exploitation since 7 September 2026, and more than 190,000 blocked attacks in the Wordfence network speak for themselves. If you do not yet have Elementor Pro 4.2.2, update now, check for signs of compromise, and enable automatic updates for security patches. Security is not a one-off action - it is a regular process.

If you do not want to handle updates, security monitoring, and backups yourself, our WordPress site management service includes proactive security oversight with immediate response to new vulnerabilities. A free initial consultation is always available.

FAQ

Frequently asked questions.

What should I do if I have Elementor Pro older than version 4.2.2?

Update to version 4.2.2 or newer immediately through wp-admin in the Plugins section. Back up your site before updating and verify that forms and key pages work correctly afterwards.

How do I find out whether my site was attacked through CVE-2026-32475?

Check the wp-content/uploads/ directory and all subdirectories for .php files - none should be present. Run a full scan through Wordfence and review server access logs for unusual POST requests to the upload directory.

Does CVE-2026-32475 affect the free Elementor plugin as well?

No. CVE-2026-32475 exclusively affects Elementor Pro, the paid premium add-on. The free Elementor plugin was not affected by this particular vulnerability. Even so, we recommend keeping all plugins up to date.

Is it safe to enable automatic updates for Elementor Pro?

Yes, automatic updates are the right choice for security patches. For production sites with complex designs we recommend a compromise: automatic updates on a staging environment and manual updates on production after verifying functionality.

What should I do if my site stopped working after the Elementor Pro update?

First try deactivating other plugins one by one - conflicts are the most common cause. If that does not help, restore your backup and repeat the update on a staging environment. You can find a detailed walkthrough in our guide to troubleshooting after a WordPress update.