CVE-2026-32475: Elementor Pro Unauthenticated File Upload Leads to RCE via PHP Webshell
CVE-2026-32475 is a critical unauthenticated file-upload vulnerability in Elementor Pro. An attacker can upload arbitrary PHP, including webshells, and achieve remote code execution on vulnerable WordPress sites. Exploitation is active. Upgrade to 4.2.2 or later and investigate for malicious uploads.
Impacted systems
| Software / application | Version / scope |
|---|---|
| Elementor Pro WordPress plugin | All versions up to and including 4.2.1; fixed in 4.2.2 and later |
Exploitation conditions
The site runs Elementor Pro 4.2.1 or earlier and exposes a public Elementor Pro Form with a File Upload field that is not required. An unauthenticated attacker submits a crafted upload and places executable PHP in the Elementor forms upload directory. Accessing that file executes code with the web server privileges. Active exploitation in the wild has been observed.
Recommended action
- Upgrade Elementor Pro to version 4.2.2 or later immediately.
- Inspect wp-content/uploads/elementor/forms/ for unexpected files, especially PHP files or web shells.
- Review web server and WordPress logs for suspicious requests to /wp-admin/admin-ajax.php tied to Elementor form submissions, including action=elementor_pro_forms_send_form.
- Treat unexpected executable files in upload directories as potential compromise. Preserve evidence and investigate persistence, new administrator accounts, modified files, and unusual outbound connections.
- If compromise is suspected, follow incident response procedures and rotate WordPress, hosting, database, and API credentials that may have been exposed.
Workarounds
If immediate patching is not possible, temporarily disable Elementor Pro or remove public forms with File Upload fields until 4.2.2 or later is installed.
Prevent PHP and other executable scripts from running under wp-content/uploads/, including /wp-content/uploads/elementor/forms/. Test server rules before deployment; this is defence in depth and does not replace patching.
If Wordfence is installed, enable Disable Code Execution for Uploads directory in Wordfence Global Options.
Indicators of compromise
File Path
/wp-content/uploads/elementor/forms/
investigate unexpected .php files and web shells
HTTP Request
POST /wp-admin/admin-ajax.php with action=elementor_pro_forms_send_form
IP Addresses
2602:fa59:10:7a1::1
185.196.220.85
103.84.230.85
103.90.148.202
216.126.225.208
167.254.240.75
167.254.241.119
114.10.17.253
114.10.45.151
2406:ef80:2:7d19::1