The Elementor Pro Vulnerability: What Happened, and Why We Don’t Build on Elementor

On 19 August 2026, a critical security flaw was disclosed in Elementor Pro, the page builder running on more than six million WordPress sites. Attackers began exploiting it the same day it was made public. Security firm Wordfence has since blocked over 190,000 attempts against the sites it protects.

The flaw carries a severity score of 9.8 out of 10, and it required no password, no account, and no login of any kind. Any stranger on the internet could upload a file of their choosing onto a vulnerable server, including one that runs commands.

A patch exists. If you run Elementor Pro, the version you need is 4.2.2 or later, and you need it today.

But the patch is not really the story. This is the fourth time since 2020 that Elementor has shipped this same category of flaw, and that pattern is worth understanding before you decide what your site should be built on.

What Actually Happened

The vulnerability, catalogued as CVE-2026-32475, lived in the Elementor Pro Form widget. If a published page on your site contained one of those forms with a file upload field that was not marked as required, the site was exposed.

The technical cause was a single misplaced word. Elementor’s validation routine loops through uploaded files to check each one, and when it encountered an empty first file it called return where it should have called continue. Instead of skipping that one empty slot and carrying on, it abandoned every remaining security check in the batch.

Attackers worked out the shape of that immediately. Submit an empty first file, attach a PHP script as the second, and the extension checks never run. The file lands in the uploads directory, and from there the attacker can call it directly and issue commands to your server.

What follows is the part that costs money: injected spam and malicious redirects, harvested customer and form data, your server quietly conscripted to attack other people, and back doors left behind for later.

One point worth being precise about: this flaw is in Elementor Pro, not the free Elementor plugin. If you only run free Elementor, this particular vulnerability did not affect you. That is not the same as being safe, and we come back to why below.

Why This One Was Different

Most WordPress vulnerabilities are far less dangerous than the headlines suggest. This was not one of those.

The Track Record

We want to be careful here, because “this plugin is insecure” is easy to say and harder to substantiate. So here are the numbers, drawn from Patchstack’s public vulnerability database, which anyone can check.

Across the Elementor family there have been 55 disclosed and patched security vulnerabilities. Forty of those sit in the free plugin, going back to 2017. Another fifteen sit in Elementor Pro.

A raw count on its own is not damning. Any widely used software accumulates disclosures, and a high number can simply mean a lot of researchers are looking. The pattern underneath the count is what matters.

Four separate times, Elementor has shipped a flaw that let files be uploaded and executed on the server:

Any software can ship a serious bug once. Shipping the same category of critical bug four times across six years points at something structural in how the code is written and reviewed, not at bad luck.

Note that two of those four are in the free plugin. If you are running an old version of free Elementor and feeling relieved that this month’s flaw was Pro-only, check your version against that December 2023 range before you relax.

What We Build On, and an Honest Comparison

Every website we build runs on the Impreza stack rather than Elementor. This week is a good illustration of why, but we want to make the comparison a fair one rather than a flattering one.

Impreza’s core is not flawless, and we are not going to claim it is. It has had two disclosed vulnerabilities in its history. What matters is what those two allowed. Both were reflected cross-site scripting issues, which require tricking a specific person into clicking a specially crafted link. Neither let anyone upload a file or run code on the server.

That distinction is the entire argument. The worst case on the platform we build on has been “an attacker fools one user into clicking a bad link.” The worst case on Elementor, four times now, has been “a stranger on the internet takes over the whole site.”

We should be equally straight about the rest of the stack. Impreza sites run WPBakery as their page builder, and WPBakery has a disclosure history of its own. The difference holds there too: those issues have overwhelmingly been stored cross-site scripting that requires the attacker to already have a login on your site. Serious enough to patch promptly, and we do. Not in the same category as handing an anonymous visitor a command prompt.

If You Are Running Elementor Right Now

Three things, in order.

Update to Elementor Pro 4.2.2 or later. This is the one that actually closes the hole. If your Elementor licence has lapsed, your site cannot pull the update automatically, and you may be sitting on a vulnerable version without any warning in your dashboard. Check the licence, not just the version number.

Look for evidence you were already hit. A successful attack leaves a PHP file in the /wp-content/uploads/elementor/forms/ directory. That folder is only meant to hold form submissions and should never contain a .php file. If you find one, treat the site as compromised and get help rather than simply deleting it, because attackers routinely leave more than one way back in.

Review your forms. Exploitation needed a published page with an Elementor Pro form containing a file upload field that was not set to required. If you have forms like that and do not genuinely need the upload field, remove it.

If you would rather not do this yourself, or you have looked and are not sure what you are seeing, contact us. We can check the site, patch it, and clean it up if something got in. You do not need to be an existing client.

How We Think About This

Ongoing maintenance is not optional, and we do it for every site on one of our plans. But we want to be honest about what maintenance can and cannot do.

Patching quickly closes a hole once it is known. It does nothing about the window between a flaw being exploited in the wild and being discovered, and in this case attackers were moving on the same day the advisory published. Speed helps. It is not a substitute for the platform having fewer of these holes in the first place.

That is why our answer to clients still on Elementor is usually a rebuild rather than a tighter maintenance schedule. A rebuild on a stack we actually trust tends to pay for itself in other ways too. Impreza sites are consistently faster and cleaner under the hood, which shows up in page speed scores and, eventually, in search rankings.

We are not raising any of this to capitalise on a scare. We patched every site on a Site Maintenance or higher retainer plan this week. We are raising it because we would rather our clients were not in a position where a patch was the only thing standing between them and a takeover.

Still on Elementor and not sure where you stand?

We are offering a free risk review for any site still running Elementor. We will look at your exposure, what a rebuild would involve, and what it would cost. If the honest answer is that you are fine to stay where you are for now, we will tell you that. Get in touch here.