Elementor Pro 4.2.1 and earlier can be compromised by an unauthenticated remote-code-execution (RCE) flaw in the Forms widget’s file-upload field; the issue is patched in version 4.2.2, so sites running the older code should upgrade immediately.

What the bug does

The vulnerability carries a CVSS 9.0 rating, meaning an attacker who can reach a vulnerable site can execute arbitrary PHP code on the server without logging in or providing any credentials. The problem resides in the way Elementor Pro processes file uploads in its Forms widget. The plugin runs two separate loops: one that validates each uploaded file, and another that saves the file to the web-accessible uploads directory.

An attacker can craft a single request that contains two files. The first file is given an empty name, which causes the validation loop to skip its check. The second file, a malicious PHP script, passes through the second loop and is written to a public folder. Because Elementor Pro names uploaded files using a timestamp, the attacker can predict the filename and later request it directly to run the code.

How the flaw emerged

The dual-loop design was intended to keep validation and storage independent, but the lack of a shared sanity check allowed the empty-name trick to slip through. The bug affects every installation that uses the Forms widget’s file-upload field, regardless of whether the site owner has enabled that feature for visitors.

Who is at risk

Any WordPress site that has Elementor Pro 4.2.1 or an earlier release installed is exposed. Because the exploit does not require authentication, even sites that restrict admin access are vulnerable. Successful exploitation gives the attacker full control over the hosting environment, opening the door to data theft, site defacement, or the deployment of ransomware.

What to do now

  • Verify the installed version with the WordPress CLI command: 

    wp plugin list --name=elementor-pro --field=version

  • If the output shows 4.2.1 or lower, update to 4.2.2 or later immediately. The update replaces the flawed upload logic with a single, atomic validation-and-save routine that blocks the empty-name bypass.

  • After upgrading, audit the uploads directory for any PHP files that match the timestamp pattern used by the plugin and remove them.

  • Consider disabling the file-upload field on public forms until the patch is applied, especially on high-traffic sites.

Counterpoint

Some developers argue that the risk is limited because the exploit requires the Forms widget to be configured with a file-upload field that is publicly accessible. However, many Elementor-based sites expose such forms for contact, job applications, or user-generated content, making the condition common enough that the vulnerability is deemed critical.

What to watch next

Security researchers expect additional advisory notes to appear as more sites report exploitation attempts. Keep an eye on official Elementor communications and reputable vulnerability databases for any follow-up patches or mitigations.

Bottom line: The RCE flaw in Elementor Pro 4.2.1 and earlier is a high-severity, no-login attack vector. Updating to 4.2.2 is the only reliable defense; delaying puts your server and data at serious risk.