Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin

1. Executive summary

Wordfence reports that Elementor Pro versions up to and including 4.2.1 permit unauthenticated arbitrary file upload when a published Form widget contains a non-required File Upload field. An attacker can bypass extension and size validation, place executable PHP under /wp-content/uploads/elementor/forms/, and request the file to obtain remote code execution and potentially take over the site. Elementor released fully patched version 4.2.2 on 19 August 2026.

No CVE identifier, CVSS score/severity, or CISA KEV exploitation state was resolved in the verified reference data; Wordfence’s “critical” description is a source characterization, not an Adverse Trace re-rating. The supplied material documents a validated proof of concept but no exploitation in the wild. All technical and prevalence claims are single-sourced to Wordfence and should be verified against client environments before enforcement.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The supplied material does not establish a client incident, service disruption, or other fact creating an item-specific obligation under UK NIS 2018.

3. Technical analysis & attack chain

The following mechanics were confirmed through Wordfence’s validated proof of concept but have not been independently corroborated.

1. Exposed configuration: The target runs Elementor Pro 4.2.1 or earlier and publishes a page containing an Elementor Pro Form widget with at least one File Upload field that is not marked as required.
2. Unauthenticated form submission: An unauthenticated visitor reaches ajax_send_form() in the Ajax_Handler class. Attacker-controlled form fields and uploaded files are wrapped in a Form_Record object.
3. Two-part upload construction: The attacker supplies the File Upload field as an array. The first element is empty and carries UPLOAD_ERR_NO_FILE; a subsequent element contains a PHP payload with an attacker-selected .php filename extension.
4. Validation bypass: ElementorPro\Modules\Forms\Fields\Upload::validation() processes the first element and executes return when it encounters UPLOAD_ERR_NO_FILE on a non-required field. This terminates validation for the entire field rather than using continue to inspect the remaining elements. Consequently, is_file_type_valid() and is_file_size_valid() are not applied to the PHP payload.
5. Processing inconsistency: Upload::process_field() handles the same empty element with continue, then processes the subsequent unvalidated payload. It derives the extension directly from the client-controlled filename using pathinfo($file['name'], PATHINFO_EXTENSION).
6. File placement: The plugin generates a filename using uniqid(), appends the attacker-controlled extension, passes it through wp_unique_filename(), and writes the file using move_uploaded_file(). The resulting permissions are set to 0644, and the path and URL are added to the form record.
7. Code execution: The PHP file is written beneath /wp-content/uploads/elementor/forms/. Requesting that file causes the payload to execute where the server permits PHP execution, providing arbitrary code execution and potentially complete site compromise.

The affected component is the Elementor Pro Forms module. All versions through 4.2.1 are affected; version 4.2.2 contains the complete fix. Wordfence estimates that Elementor Pro has approximately six million active installations.

The source does not provide a payload sample, fixed filename, hash, attacker infrastructure, malware family, persistence mechanism, privilege-escalation method, command-and-control channel, lateral-movement activity, or evidence of data exfiltration. Webshell deployment is described as a possible post-exploitation technique, not observed campaign activity. No threat actor is identified or attributed.

No verified CVSS severity or CISA KEV state is available. A validated proof of concept establishes exploitability, but the supplied material does not establish active exploitation.

4. Mitigation & containment

P1 — within 24 hours

• Upgrade every Elementor Pro deployment running 4.2.1 or earlier to version 4.2.2 or later, and verify the deployed version after installation.
• Until upgrading is complete, disable Elementor Pro, unpublish affected forms, or remove the File Upload field from exposed Form widgets. Marking the field required removes the reported prerequisite but should be treated only as temporary risk reduction.
• For Wordfence deployments, enable the firewall’s Malicious File Upload protection and the Global Options setting Disable Code Execution for Uploads directory. These controls are defence-in-depth and do not replace the update.
• Block PHP execution and public retrieval of PHP files beneath /wp-content/uploads/elementor/forms/ using the available web-server, hosting, or security control.
• If suspicious files or requests are identified, isolate the WordPress host and preserve the uploaded files, filesystem metadata, form submissions, WAF events, and HTTP access logs.

P2 — within 72 hours

• From the WordPress document root, identify PHP files in the affected upload directory:

find wp-content/uploads/elementor/forms/ -type f -name '*.php' -print

• Treat unexpected PHP files in this directory as suspicious. Do not execute them; preserve and hash them before containment.
• Correlate file creation times with unauthenticated Elementor form submissions and subsequent requests to the generated PHP path.
• Review affected hosts for additional unauthorised files or configuration changes. Updating the plugin does not remove payloads uploaded before remediation.
• Where compromise is confirmed, rebuild from a trusted source and rotate credentials or secrets accessible from the affected host after determining exposure.

P3 — within seven days

• Inventory all public Elementor Pro forms and document which permit file uploads.
• Enforce code-execution denial across WordPress upload directories and test that direct requests to uploaded PHP files cannot execute.
• Add monitoring for executable-file creation and retrieval beneath Elementor upload paths.
• Establish an update control that detects Elementor Pro versions below 4.2.2 across managed and third-party-hosted WordPress estates.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

The source provides no payload strings suitable for a defensible YARA rule. The following Sigma rule detects requests to execute PHP beneath the affected upload directory; adapt url.path to the local web-log schema.

title: PHP Request Under Elementor Forms Upload Directory
status: experimental
description: Detects requests for PHP files beneath the Elementor forms upload directory.
references:

  - https://www.wordfence.com/blog/2026/08/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin/
author: Adverse Trace
date: 2026-08-20
logsource:
  category: webserver
detection:
  selection:
    url.path|contains: '/wp-content/uploads/elementor/forms/'
    url.path|endswith: '.php'
  condition: selection

Validate matches against authorised content and correlate them with preceding Elementor form submissions or file-creation events.

7. Sources

• Wordfence, “Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin,” https://www.wordfence.com/blog/2026/08/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin/, 20 August 2026.

8. Adverse Trace position

Adverse Trace assigns immediate P1 remediation priority to Elementor Pro 4.2.1 and earlier where the exposed form condition exists, based on the unauthenticated PHP upload and resulting code-execution path. We do not assign a formal severity: no verified CVSS score/severity or CISA KEV state was resolved, Wordfence’s “critical” label remains a source characterization, and no in-the-wild exploitation is established. The findings and behavioural indicators are single-sourced; verify before enforcement. Adverse Trace will monitor for a confirmed CVE identifier, CISA KEV status, independent technical corroboration, exploitation reporting, and campaign-specific indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.