WordPress security experts Wordfence reported that Elementor Pro fixed a critical arbitrary file upload vulnerability on August 19, 2026.
Under the right conditions, this security flaw made it possible for an attacker to upload malicious executable files directly to small business websites. Elementor confirms that version 4.2.2 of Elementor Pro fixes the vulnerability.
What is Elementor?
Elementor is a popular page-building plugin for WordPress that functions as a code-free design and layout tool. Because of its popularity, it comes bundled with many WordPress themes and websites, meaning that small business owners may be running the plugin on their websites without even knowing it.
How do you update Elementor Pro?
Elementor Pro can generally be updated like any other WordPress plugin: go to your WordPress dashboard, click Updates or Plugins, and click Update Now under Elementor Pro.
In some cases, you may instead need to log in to your Elementor account, download the latest .zip file, and update the plugin manually.
Why this matters
Security flaws in popular plugins like Elementor are attractive targets for bad actors because they can exploit the same vulnerability across the large number of websites running the software.
In this particular case, the ability to upload arbitrary executable files leaves out-of-date small business WordPress websites incredibly vulnerable.
Not sure what to do next?
If your small business website is built on WordPress and you need a hand making sure things are secure and up to date, I offer a $149 WordPress website checkup. All you have to do is send me a note with your details, and I’ll handle the rest.