Affected installations
CVE-2026-32475 affects Elementor Pro versions through 4.2.1 and is fixed in 4.2.2 [S1][S2]. The flaw is in the Forms widget's File Upload field: validation and file handling can disagree when a non-required upload field contains an empty entry followed by another file [S1]. This can allow an unauthenticated attacker to upload a file type that should have been rejected. Whether that file becomes executable depends on the site's web-server and upload-directory configuration [S1].
A site is exposed only when the affected Elementor Pro version is active and a published page contains a Form widget with at least one non-required File Upload field [S1][S2]. The vendor changelog confirms that 4.2.2 is an available Elementor Pro release; newer supported releases are also available [S3].
Active exploitation and impact
Wordfence reported that attackers began targeting the vulnerability on August 19, 2026, the day of public disclosure, and that its firewall had blocked more than 190,000 exploit attempts by September 2 [S2]. Wordfence describes observed attempts to place executable PHP files in the Elementor Forms upload directory; successful execution can lead to remote command execution and site takeover [S2].
These observations establish active targeting, not that every vulnerable-looking site has been compromised. A version alone does not prove that the required Form widget is published, that the upload field is non-required, or that uploaded scripts can execute [S1][S2].
Remediation and incident review
Upgrade Elementor Pro to 4.2.2 or a newer supported release immediately [S1][S2]. Update Elementor and Elementor Pro together according to the vendor's update guidance, back up the site first, and verify the active plugin version after deployment [S3][S4].
Review the Elementor Forms upload directory and web-server access logs for unexpected executable files or suspicious form-upload activity during the exposure window [S2]. Prevent script execution in upload directories, keep uploads outside executable paths where possible, and treat any unexpected executable file as an incident requiring containment, credential review, and restoration from trusted artifacts [S2].
Repository evidence and limits
A safe repository check can identify an exact affected Elementor Pro plugin version and, when source is available, the affected Forms upload implementation [S1]. That evidence is useful for patch triage without submitting files or attempting code execution [S1].
Repository or passive web evidence cannot prove the effective deployed version, whether a vulnerable Form widget is published, whether an upload field is non-required, whether PHP execution is enabled in the upload directory, or whether exploitation occurred [S1][S2]. FixVibe therefore keeps this article as a research note until any scanner coverage is implemented, tested, deployed, and verified. FixVibe will not upload executable files or reproduce the bypass against a live site [S1][S2].