Elementor Pro 4.2.1 vulnerability: active attacks target file uploads

Elementor Pro 4.2.1 vulnerability at a glance

This is not a routine low-risk plugin warning. The vulnerability is tracked as CVE-2026-32475 and carries a CVSS score of 9.8 out of 10, which puts it in the Critical category. The fixed release is Elementor Pro 4.2.2.

What happened with Elementor Pro 4.2.1

Wordfence disclosed the vulnerability on 19th August 2026. According to its attack report, attackers began targeting websites on the same day. By 2nd September, the Wordfence firewall had blocked more than 190,000 exploit attempts.

That number is not the same as 190,000 compromised sites. It counts blocked attempts, and one website can receive many attempts. It still tells us something important: this is being used in the wild, not sitting quietly in a vulnerability database waiting for somebody to notice it.

Elementor released version 4.2.2 with the fix on 19th August. The safest response is to install that release or a newer patched version, then consider whether the site needs a closer check based on the conditions below.

How the file upload flaw works in plain English

Elementor Pro includes a Form widget that can accept files from visitors. Normally, the plugin checks each upload and rejects file types that should not be placed on the server. A mistake in the validation loop means that a specially arranged upload can make those checks stop too early.

The attacker places an empty item first and a second file after it. When the File Upload field is optional, the empty item can cause validation to end before Elementor checks the remaining file. That second file may then be saved with a dangerous extension such as .php.

A PHP file is code, not an ordinary image or document. If the attacker can request it from the web, they may be able to run commands on the server. Security teams call that remote code execution. For a WordPress owner, the practical meaning is simpler: somebody could take control of the site without first logging in.

Which Elementor Pro sites are exposed?

The disclosed attack path needs these conditions to line up:

• Elementor Pro 4.2.1 or an earlier version is active.
• A public page contains an Elementor Pro Form widget.
• The form has at least one File Upload field.
• That File Upload field is not marked as required.

If your site does not have that form configuration, this specific exploitation route should not be available. That is useful context, but it is not a reason to leave Elementor Pro 4.2.1 installed. Forms change, old landing pages are easy to forget, and updating removes the known weakness rather than relying on a page audit staying perfect.

The vulnerability is unauthenticated. An attacker does not need a customer account, an editor login, or a stolen administrator password. They only need to reach a suitable public form on an affected site.

What to do if you have Elementor Pro 4.2.1

Start with the update, then decide how far the review needs to go.

1. Check the installed version. Open Plugins > Installed Plugins and find Elementor Pro. If it shows 4.2.1 or anything earlier, treat it as affected.
2. Update to 4.2.2 or newer. Confirm the new version number after WordPress reports that the update has finished.
3. Test the site and its forms. Check the front end, send a test submission, and confirm any legitimate uploads still arrive where expected.
4. Review the exposure window. If an affected version was online from 19th August onwards and the site had a suitable upload form, arrange a security check rather than assuming the update tells you what happened before it was installed.
5. Remove Elementor Pro if it is no longer needed. An unused premium plugin should not remain forgotten on the server. Keep it updated if you need it, or remove it properly if you do not.

Signs that the Elementor Pro vulnerability was exploited

Wordfence says a successful attack writes an executable PHP file beneath /wp-content/uploads/elementor/forms/. That folder is intended for form uploads and should not contain PHP. Any .php file there is a strong warning sign and deserves investigation.

Your hosting provider can also review web server access logs for suspicious requests to /wp-admin/admin-ajax.php involving the Elementor Pro form submission action. Logs are useful, but the absence of a matching entry does not prove the site is clean. Logs may have expired, been rotated, or not captured enough detail.

Because successful exploitation can lead to full site control, the review should also cover:

• administrator accounts that nobody on your team created
• new or modified plugins, themes, and must-use plugins
• unexpected scheduled tasks or changes to WordPress configuration
• other recently changed PHP files outside the normal update window
• hosting, database, SFTP, and administrator credentials if compromise is confirmed

Do not rely on the WordPress Users screen alone. A backdoor can exist without a visible administrator account. If you find an unfamiliar file, preserve enough information for somebody to investigate it before deleting everything around it.

Is a firewall enough protection?

A web application firewall can block a malicious upload before it reaches the plugin. Wordfence reports that its built-in Malicious File Upload protection blocks attempts against this vulnerability. It also recommends enabling its option that prevents code execution from the uploads directory.

That is useful protection, but it is not a replacement for the Elementor update. Firewall rules can be disabled, misconfigured, or absent from a different site. Updating to Elementor Pro 4.2.2 or later fixes the vulnerable code itself and gives you a much simpler state to verify.

How BugShield can help after the Elementor Pro 4.2.1 warning

Fast security updates are easier when somebody owns the routine. BugShield maintenance plans combine managed plugin updates with WordPress monitoring, off-site backups, and a secure record of the work completed on each site.

If you only need Elementor Pro updated and tested, you can request a one-off fix. If there are suspicious PHP files, unknown administrators, or other signs of access, choose WordPress malware removal so the review covers the wider site rather than stopping at the plugin version.

For most site owners, the immediate job is short: move beyond Elementor Pro 4.2.1, confirm the update, and check whether the affected form setup was publicly available while attacks were active.