Somewhere out there, a form field marked "optional" is having an identity crisis. It turns out that when you don't lock down an optional file upload field, hackers treat it less like a suggestion and more like an open invitation.
An Empty File Was All It Took
CVE-2026-32475 is an unauthenticated arbitrary file upload flaw in Elementor Pro versions 4.2.1 and earlier, carrying a maximum-alarm CVSS score of 9.8. The bug lives in the plugin's upload validation: when an attacker submits an empty file as the first item in an array, the validation loop exits early via a stray return instead of looping through to check every file — meaning a malicious PHP file slipped in right behind it sails through unchecked.
The catch only works on public pages running an Elementor Pro Form with a File Upload field that isn't required, but with roughly 6 million active installs, that's not exactly a rare setup. Wordfence says it started seeing exploitation the same day Elementor shipped the fix, version 4.2.2, on August 19 — and has since blocked over 190,000 attack attempts.
6 Million Sites and the Patch Nobody Applied Fast Enough
This is the same story that plays out every time: a fix ships, and a race begins between site owners updating and bots scanning for the ones who didn't. A CVSS 9.8 with public exploitation isn't a "get to it next sprint" bug — successful exploitation hands an attacker a working PHP shell and, from there, your whole site.
The part that should sting is how avoidable the entry point was. Not a zero-day in some obscure core routine — an optional field that nobody thought to double-check because "optional" sounds harmless. It rarely is.
Six million sites is a big blast radius for a bug that boils down to one skipped validation check — a good reminder that plugin sprawl is a security surface, not just a feature list.
If you're not 100% sure which of your plugins are one skipped `continue` away from becoming a headline, our free security checklist walks through exactly what to audit — grab it here before the next CVE drops.
Source: BleepingComputer