Elementor has patched an unauthenticated arbitrary file upload vulnerability in Elementor Pro that could lead to remote code execution. The issue affected the Forms module’s File Upload field, where a mismatch in how empty file entries were handled during validation and processing could allow an attacker to bypass the file extension check and upload a PHP file to a publicly accessible directory.
The vulnerability allows unauthenticated file uploads
The vulnerability was reported to Patchstack by security researcher Tin Pham on July 16, 2026. The same vulnerability was also reported to Wordfence on July 24 by Austin Ginder, earning him a bug bounty of $15,600.
It affects Elementor Pro 4.2.1 and earlier and involves the File Upload field in the plugin’s Forms module, and the vulnerability has a CVSS score of 9.0.
Both Patchstack and Wordfence identify the same requirement for exploitation: a published Elementor page containing a Form widget with at least one File Upload field that is not marked as required. Patchstack’s report further notes that the information needed to construct the upload request is available in the public page HTML, and that the upload is handled through the elementor_pro_forms_send_form AJAX action without cookies or a nonce.
According to the Patchstack report, the vulnerability stems from how the File Upload field validates and processes uploaded files. The plugin handles these operations in two separate loops. The first checks each uploaded file’s extension against the configured allowed types and a blocklist that includes PHP and other executable extensions. The second processes the files and moves them into Elementor Pro’s public forms directory.
The two loops handle empty file entries differently. PHP reports an empty upload as UPLOAD_ERR_NO_FILE. When the validation loop encounters an empty entry, it uses return, which ends the validation method and prevents subsequent entries from being checked. The processing loop handles the same empty entry with continue, skipping it and continuing to the next file.
An attacker can exploit this difference by submitting two file parts for the same File Upload field: an empty first entry followed by a PHP file. The empty entry causes the validation process to stop before the PHP file is checked against the extension blocklist. The processing loop does not stop, however, and continues to the PHP file, allowing it to reach the file-moving step without passing the extension check.
The plugin normally rejects PHP files through its extension validation. In the vulnerable code, the PHP file can instead reach the processing step, where the plugin takes the extension from the submitted filename, generates a new filename using PHP’s uniqid() function, and applies wp_unique_filename() before moving the file.
The resulting file is placed in wp-content/uploads/elementor/forms/, a public, web-accessible directory. The original filename is discarded, while its extension is retained in the generated filename. This allows a PHP file to be stored in the public forms directory and requested directly.
Patchstack notes that the upload response does not return the generated file path. However, its report explains that the filename can be recovered because PHP’s uniqid() function produces a time-based value. The report also describes a separate method of obtaining the uploaded file URL through Elementor Pro’s form email notifications. The default [all-fields] notification includes the uploaded file’s URL, and when an autoresponder email action is enabled, the notification can be sent to the email address supplied with the form.
Once the uploaded PHP file is accessed, Patchstack states that it can be used to achieve remote code execution without authentication.
Elementor Pro 4.2.2 was released on August 19, 2026, fixing the vulnerability. Also, sites that were running a vulnerable version should inspect wp-content/uploads/elementor/forms/ for PHP files or any other file types that their forms are not intended to accept.