What Happened
Researchers disclosed CVE-2026-32475, a critical vulnerability in the Elementor Pro WordPress plugin carrying a CVSS score of 9.0, affecting versions up to and including 4.2.1. The flaw sits in the File Upload module, where validation and processing run through two separate loops, each handling empty filenames differently. By submitting two file parts inside a single File Upload field, an attacker bypasses the extension blocklist entirely and writes an executable PHP file to a publicly reachable directory, gaining code execution on the server. Exploitation needs no account or credentials, only a live site running a published Elementor form containing a File Upload field, a common setup on contact and application pages. Elementor fixed the issue in version 4.2.2, released August 19.
Why This Matters for Canadian Organizations
Elementor Pro runs on millions of WordPress sites worldwide, including small business storefronts, non-profit pages, and marketing sites operated by Canadian organizations without dedicated security staff. A flaw needing no authentication and no user interaction removes the usual barriers limiting exposure, meaning any site with a public upload form sits exposed until patched. Under PIPEDA, an organization collecting personal information through a compromised web form carries breach notification obligations once attacker access to the data becomes confirmed. Small and mid-sized Canadian businesses, a segment with high WordPress adoption and often minimal patch management, face particular risk given how quickly researchers and attackers alike move from disclosure to working exploit code.
What to Do
Site operators running Elementor Pro should update to version 4.2.2 immediately, treating the patch as urgent rather than routine given the low barrier to exploitation. Teams unable to patch right away should review or temporarily disable Elementor forms containing File Upload fields and audit the uploads directory for unexpected PHP files. Web hosts and agencies managing WordPress sites on behalf of Canadian clients should confirm plugin inventories and push the update across every affected instance rather than relying on individual site owners to act. Technical detail on the flaw is available from The Hacker News.
