Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated remote code execution vulnerability in Elementor Pro WordPress plugin affecting all versions up to and including 4.2.1 The flaw exists in the Forms module's File Upload field, where extension validation and file-move operations run in separate loops with inconsistent handling of empty file entries, allowing PHP file uploads to bypass blocklists Exploitation requires only a published Elementor page with a File Upload field (default "Required
Analysis
TL;DR
- CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated remote code execution vulnerability in Elementor Pro WordPress plugin affecting all versions up to and including 4.2.1
- The flaw exists in the Forms module's File Upload field, where extension validation and file-move operations run in separate loops with inconsistent handling of empty file entries, allowing PHP file uploads to bypass blocklists
- Exploitation requires only a published Elementor page with a File Upload field (default "Required" toggle off), and the uploaded PHP file is written to
wp-content/uploads/elementor/forms/<uniqid>.php - Patchstack researcher Tin Pham (TF1T) discovered the vulnerability; patch version 4.2.2 was released on August 19, 2026, after reporting on July 16, 2026
- The vulnerability coincides with broader WordPress security concerns including CVE-2026-65640 (CVSS 8.8) and the StopAndProtect malware operation compromising thousands of WordPress sites
Why It Matters
This vulnerability is significant because it enables unauthenticated remote code execution on widely deployed WordPress sites, requiring no special configuration or hardened settings to exploit. The default state of the File Upload field makes this a realistic threat for job-application forms, support-ticket attachments, and photo/ID upload forms that are common across the WordPress ecosystem.
Technical Details
- Vulnerability Type: Unrestricted file upload leading to remote code execution (CVE-2026-32475, CVSS 9.0)
- Root Cause: The Forms module's File Upload field performs extension checking and file-moving in two separate loops with different handling of empty file entries; submitting two file parts for the same field allows an attacker to bypass the extension blocklist entirely
- Affected Versions: All Elementor Pro versions prior to and including 4.2.1
- Exploit Conditions: Only requires a published Elementor page containing a Form widget with a File Upload field; the field's "Required" toggle being off is the default state
- File Storage Path: Uploaded PHP files are written to
wp-content/uploads/elementor/forms/<uniqid>.phpusing PHP'suniqid()function - Patch: Version 4.2.2 released on August 19, 2026
- Related Vulnerability: CVE-2026-65640 (CVSS 8.8) in WordPress core 4.7–7.0.4, involving malicious Postscript file upload via ImageMagick/Ghostscript by Author-level users or higher
Industry Insight
- WordPress site operators should immediately update Elementor Pro to version 4.2.2 or later and audit all sites for published pages containing File Upload form fields, as the vulnerability is trivially exploitable with no authentication required
- The ease of exploitation and common default configuration make this a high-priority patch for any site using job applications, support tickets, or document upload forms—organizations should prioritize updating over routine maintenance schedules
- The concurrent discovery of the StopAndProtect operation and the WordPress core CVE-2026-65640 highlights a broader trend of file-upload-based RCE vulnerabilities being actively exploited in the wild; proactive security scanning for unauthorized modifications and unknown accounts is essential for WordPress deployments
Disclaimer: The above content is generated by AI and is for reference only.