A critical vulnerability in Elementor Pro can allow attackers to upload executable files and run code on a WordPress server, BleepingComputer reports, citing research from Patchstack. The flaw is tracked as CVE-2026-32475 and affects Elementor Pro versions before 4.2.2. The issue sits in Elementor Pro’s File Upload module. According to Patchstack’s analysis as described by BleepingComputer, the bug comes from a mismatch between how the plugin validates uploaded files and how it later processes them. The two steps treat an upload part with an empty filename differently. That difference creates the exploit path. BleepingComputer reports that an attacker can craft a multipart upload where the first entry has an empty filename and a later entry contains a malicious PHP payload. The validation routine can stop after the empty entry and fail to inspect the later payload, while the processing step skips the empty part and moves the malicious file into a public Elementor uploads directory. The reported destination is wp-content/uploads/elementor/forms/. Once the attacker determines the uploaded file’s URL and requests it, the server’s PHP interpreter can execute the file, allowing arbitrary code to run with the privileges of the web server, according to BleepingComputer’s summary of Patchstack’s findings. Patchstack also said the generated filename can be inferred because it uses PHP’s uniqid() function, which is time-based rather than random. BleepingComputer reports that an attacker may be able to brute-force the name using timing, and in some configurations could receive the exact URL through an autoresponder email. The affected surface is narrower than “all Elementor sites,” but the exact phrasing matters. Patchstack said exploitation requires a target site to have a published Elementor form with a File Upload field. Elementor told subscribers, according to BleepingComputer, that the risk applies only to websites using an Elementor Pro Form with an upload file form field and the multiple file upload option enabled; Elementor said that option is disabled by default. Elementor Pro is the paid version of Elementor, the widely used drag-and-drop WordPress website builder. BleepingComputer notes that Elementor has more than 10 million active installs, while the Pro product adds features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools. The disclosure timeline in the report is relatively tight. Patchstack learned of CVE-2026-32475 from researcher Tin Pham on July 16 and shared the information with Elementor. BleepingComputer reports that the plugin developer prepared a fix the next day, Patchstack verified it on August 3, and Elementor delivered the fix the day before BleepingComputer’s August 20 report. The immediate operational guidance is straightforward: administrators should update Elementor Pro to the latest release, with versions before 4.2.2 treated as affected. Sites using Elementor Pro forms with file uploads are the affected surface described by Patchstack and Elementor. Who benefits: Attackers benefit if sites remain on Elementor Pro versions before 4.2.2 and expose the vulnerable upload path. Defenders benefit from a clear update target and from knowing which forms to inspect first. Who's exposed: Exposure appears concentrated on Elementor Pro sites using forms with file uploads; Elementor’s notice further narrows that to cases where multiple file upload is enabled. The cluster does not establish that every Elementor or Elementor Pro installation is vulnerable.