WordPress hosts and agencies have another plugin patch to prioritize: a newly disclosed Elementor Pro flaw can turn a file-upload form into a route for remote code execution on the server.

BleepingComputer reported on August 20 that CVE-2026-32475 affects Elementor Pro versions before 4.2.2. The issue sits in the plugin’s File Upload module, where validation and processing can disagree about a multipart upload that includes an empty filename followed by a malicious payload.

The hosting impact is straightforward: if a vulnerable site has an Elementor Pro form with a File Upload field and the multiple-file upload option enabled, an attacker may be able to place executable PHP under wp-content/uploads/elementor/forms/. Patchstack, which analyzed the bug, said the filename generation can also be predictable enough for an attacker to locate the uploaded payload.

Elementor told customers that the risky configuration is limited, because multiple uploads are disabled by default, but the plugin’s footprint makes the patch cycle important for managed WordPress providers, maintenance firms, and shared-hosting support teams.

What site operators should do

• Update Elementor Pro to version 4.2.2 or later.
• Inventory sites that use Elementor Pro forms with file-upload fields, especially where multiple uploads are enabled.
• Inspect wp-content/uploads/elementor/forms/ for PHP files or unfamiliar artifacts; patching does not remove files that may already have been uploaded.
• Confirm web-server rules prevent PHP execution from upload directories wherever possible.

Patchstack said it had not observed active exploitation at the time of disclosure, but the combination of WordPress scale, public technical detail, and server-side code execution makes this a hosting-relevant issue rather than a routine plugin update.

Source: BleepingComputer; primary technical analysis from Patchstack.