What happened
Elementor is the page builder behind a large share of WordPress sites, and its paid Pro version adds the form widget most businesses use for contact and quote requests. Patchstack found that in Elementor Pro 4.2.1 and older, a form with a File Upload field accepts files it shouldn’t, from anyone, with no login. Get the right file onto the server and an attacker can run code on it. Elementor fixed it in 4.2.2 on August 19, 2026.
As of today the flaw is not on CISA’s list of actively exploited vulnerabilities, and Patchstack hasn’t reported attacks. It is rated critical anyway, and automated scanners go looking for exactly this kind of hole, so treat an old version as an open door.
Who is exposed
You need two things for this to matter: Elementor Pro older than 4.2.2, and a published form with a File Upload field (a résumé upload, a “send us a photo” box, a document drop). Per Patchstack, the field’s Required toggle being off, which is the default, is part of the condition.
If none of your forms take files, the flaw can’t be reached today. It is one form edit away, though: add an upload field next month and the door opens. Update either way.
Our free website check reads plugin versions from your public pages and flags Elementor Pro versions with known flaws.
What to do
- Check your Elementor Pro versionIn WordPress, go to Plugins and find Elementor Pro. Anything below 4.2.2 needs the update. Elementor Pro needs an active license to update from the dashboard, which is a common reason sites fall behind.
- Update to 4.2.2 or newerTake a backup first, update, then test your forms.
- If you had an upload form on an old version, look for leftoversPatchstack says to check the wp-content/uploads/elementor/forms/ folder for files your forms shouldn’t accept, especially anything ending in .php. Updating doesn’t remove a file someone already got in.
If you find something you can’t explain in that folder, don’t just delete it. Change the site’s passwords and get the server checked properly; our incident response team can help.
Sources
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a cybersecurity and software firm in Myrtle Beach, South Carolina. This is general guidance, not a review of your systems.