Your website has a contact form, and somebody can probably attach a file to it: a CV, a photo, a quote request in PDF. That form is a door. It accepts a file from a complete stranger, decides whether the file is acceptable, and saves it into a folder that your web server will happily show to anyone who asks. This month, two of the most popular versions of that door turned out to be unlocked. If you built your site with Elementor Pro, the fix is version 4.2.2, released on 19 August, and anything earlier needs updating today.[1] If you use Forminator Forms, the fix is 1.56.2.[4] Everything below explains why, and what to check once you have updated.
Elementor Pro: update to 4.2.2 today
On 19 August, Elementor released version 4.2.2 of Elementor Pro to fix CVE-2026-32475, a flaw rated 9.0 out of 10. Every version up to and including 4.2.1 is affected. It lets an attacker with no account and no help from anyone upload a PHP file to the site and then run it, using nothing more than a web request to your contact form.[1][2] The researchers reported it to Elementor on 16 July, and the fix took just over a month to arrive.[1]
Two honest qualifications. First, the flaw only applies if your site has a published Elementor form with a File Upload field, and that field has the “multiple files” option switched on, which is off by default.[2] Second, at the time of writing nobody has reported seeing it used in real attacks, and no working exploit has been published.[2] Neither of those is a reason to wait. The free version of Elementor alone runs on more than ten million sites, and Pro is the paid tier a great many of them have added, so the people who write exploits for a living have every reason to get round to this one.[2]
How the door opens
The mechanism is simple enough to explain in three sentences. The plugin checks each uploaded file’s extension in one loop, and then moves the files into place in a second loop. The two loops disagree about what to do when they meet an empty file entry: the first one stops checking altogether, the second one just skips it and carries on. So an attacker sends two file parts for a single upload field, an empty one followed by the real payload, and the check gives up before it reaches the file that matters, while the move goes ahead anyway.[1]
What the attacker gets is a PHP file sitting in wp-content/uploads/elementor/forms/, a folder the web server serves publicly.[1] They open it in a browser and it runs, with the same permissions as your website. In the trade this is called a web shell: a hidden page that runs commands. From there an attacker can read your database, add an administrator, install whatever they like, or simply use your server to attack other people. It is worth knowing that updating the plugin closes the door but does not remove anything that came through it while it was open.[2]
Forminator: the same flaw, a fortnight earlier
Forminator Forms is a free form builder with more than 600,000 active installations. CVE-2026-15748, rated 9.8, is the same class of flaw: insufficient checking of what an uploaded file actually is, allowing an unauthenticated attacker to place a PHP file on the server.[4][5] It was reported through Wordfence’s bug bounty programme on 11 July and fixed in version 1.56.2 on 31 July.[5] When the details were published this month, WordPress’s own figures suggested roughly half of those installations were still on a vulnerable version, which puts more than 300,000 sites in the exposed column.[4]
That figure deserves stating without judgement, because it is the real story about WordPress. A fix existed for a fortnight. Half the sites that needed it had not applied it. Nobody running those sites was careless; they installed a form plugin, which is exactly what they were told to do, and nobody was watching on their behalf the day a flaw appeared.
What to do right now
- Check whether Elementor Pro is installed, and its version. In the dashboard, go to Plugins. Anything below 4.2.2 needs updating today. Take a backup first.
- Check for Forminator Forms and update it to the current version if it is below 1.56.2.
- Look inside
wp-content/uploads/elementor/forms/for any file ending in.php. Your hosting file manager or FTP will show you. There should not be any. - Look through your uploads folders generally for files with executable extensions, such as
.php,.phtmlor.phar. Uploads should be documents and images, nothing else. - Review your administrator accounts. If there is one you cannot put a name to, that is a finding, not a puzzle.
- If you find a PHP file where one should not be, assume the site is compromised. Restore from a backup taken before the file appeared, then apply the update. Cleaning around a web shell rarely works, because you are unlikely to find everything it left behind.
Your contact form is an upload endpoint
The wider lesson is short. Any form that accepts a file is an upload endpoint, whatever the plugin calls it, and an upload endpoint is the most dangerous thing a website can expose to strangers, because every step of handling a file has to be right. If you do not need file attachments on your contact form, turn them off. That one setting removes the entire attack surface for both of this month’s flaws, and for the next one in the same family, which will arrive. If you do need uploads, keep them on one form, restrict the file types to the few you genuinely want, and know where they land.
What the hosting layer can do
None of this is something a host can fix for you at the plugin level; the code is the code, and only the plugin’s author can change it. What the hosting layer can do is change how much an unpatched day costs. A web application firewall in front of the site blocks a large share of exploit attempts before they reach the plugin at all. Daily backups that you can actually restore turn a compromise into a bad afternoon rather than a lost business. And on managed WordPress plans the plugin updates that most site owners postpone are applied for them, which is the difference between a fortnight of exposure and a day. On Lucid Cloud Platform’s managed WordPress and concierge plans, all three of those are standard: a firewall in front of your site, automated off-site backups with one-click restore, and updates applied on your behalf.
If you are not sure where your site stands, we will gladly run a free WordPress health check: a plugin and version inventory, a scan of your uploads folders for anything that should not be there, a review of administrator accounts, and a test restore of your backup so you know it works before you need it. For sites on unmanaged hosting, that check is usually the moment the managed conversation starts. It is also worth having even if you change nothing, because the advice above is free and the only thing it costs is twenty minutes.
Related reading
Sources
- Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin, Patchstack, August 2026.
- Critical Elementor Pro bug exposes WordPress sites to RCE attacks, BleepingComputer, 20 August 2026.
- Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code, The Hacker News, August 2026.
- 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw, SecurityWeek, August 2026.
- Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads, The Hacker News, August 2026.
