A critical flaw in Elementor Pro lets an unauthenticated visitor upload a PHP file through an ordinary contact form and execute it on the server. Researcher Tin Pham, also known as TF1T, reported the bug to Patchstack, and Elementor shipped the fix in version 4.2.2 on 19 August 2026.
Tracked as CVE-2026-32475 and rated CVSS 9.0, the vulnerability affects Elementor Pro 4.2.1 and earlier. Patchstack calls it a "textbook desynchronization flaw": inside the Forms module's File Upload field, the code that validates an upload and the code that saves it read the same submission by different rules.
How CVE-2026-32475 Works
In modules/forms/fields/upload.php, the validation() method checks each submitted file's extension against an allowed list and a blocklist covering php, phtml, asp and other executables. The moment it hits an empty file part, it returns and stops checking anything after it. process_field(), which moves uploads to disk, merely skips that empty part and carries on.
So an attacker sends two parts for one field: a blank entry first, then the PHP payload. The validator quits before reaching the payload, the mover writes it to wp-content/uploads/elementor/forms/ as <uniqid>.php, and requesting that URL runs the code. The submission goes through the elementor_pro_forms_send_form AJAX action with no cookie and no nonce.
The filename is no obstacle. uniqid() is time-based: its first eight hex digits encode the epoch second the server's Date header discloses, leaving five microsecond digits to brute-force — and forms with an autoresponder mail the exact file URL back to the attacker.
Which Sites Are Affected
One condition matters: a published Elementor page with a Form widget and a File Upload field — job applications, support tickets, "attach a receipt" pages. The Required toggle is off by default, the state the attack needs, and the post ID, form ID and field name all sit in the page's public HTML.
How to Check Your Site for a Shell
Updating closes the hole but does not remove a shell already on disk. List the forms directory for executables with find wp-content/uploads/elementor/forms/ -name "*.php", then grep access logs for POSTs to admin-ajax.php carrying elementor_pro_forms_send_form and any GET that follows into that directory.
The timeline deserves attention. Patchstack received the report on 16 July, and Elementor had a patch prepared on 17 July, yet the release did not reach users until 19 August — 34 days with a working fix in hand.