Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
A critical flaw in the Elementor Pro WordPress plugin, CVE-2026-32475, allows unauthenticated attackers to upload dangerous PHP files and achieve remote code execution.
Intelligence analysis by Gemini 2.5 Flash
The vulnerability stems from a discrepancy in the Forms module's File Upload field, where extension checks and file-move steps are handled differently for empty file entries. This allows attackers to bypass security measures and write malicious PHP scripts into public directories on affected WordPress sites.
Imagine your website is like a clubhouse, and Elementor Pro is a special tool that lets people fill out forms, like signing up for a club. This tool had a secret trick where if someone tried to upload a picture, they could actually sneak in a secret instruction disguised as a picture. It's like telling the clubhouse manager, "Here's my photo," but the photo actually says, "Now, let me take over the whole clubhouse!" This trick worked even if they weren't a member, so anyone could cause trouble. Luckily, the club managers found the trick and fixed the tool so it can't happen anymore.
Analysis
CVE-2026-32475
The recently disclosed vulnerability, identified as CVE-2026-32475, is a critical security flaw with a CVSS score of 9.0 out of 10.0, indicating its severe nature. This vulnerability is categorized as an unrestricted upload of a file with a dangerous type, specifically allowing PHP files to be uploaded.
The core of the issue lies within the Elementor Pro Forms module's File Upload field. Researchers at Patchstack discovered that the plugin's extension check and the subsequent file-move step operate in two separate loops, which handle empty file entries inconsistently. This architectural oversight creates a critical window for attackers to exploit.
By submitting two file parts for the same field, an unauthenticated attacker can effectively bypass the extension blocklist designed to prevent malicious uploads. This allows them to write a PHP file directly into a public directory on the server, specifically wp-content/uploads/elementor/forms/<uniqid>.php, where <uniqid> is a unique identifier generated by PHP's uniqid() function. This mechanism transforms a seemingly restricted file-upload feature into a potent unauthenticated remote code execution primitive.
Elementor Pro
Elementor Pro is a widely used WordPress plugin, making this vulnerability particularly impactful due to its extensive adoption across numerous websites. The flaw specifically affects all versions of the plugin prior to and including version 4.2.1. The only precondition for a successful attack is that the target WordPress site must have at least one published Elementor page that incorporates a Form widget with a File Upload field.
This configuration is described as extremely common in everyday website operations, frequently found in forms for job applications, support tickets, or any scenario requiring users to attach files like photos or receipts. Furthermore, the 'Required' toggle for the file upload field is off by default, meaning no unusual or hardened settings are needed for the vulnerability to be present and exploitable. This default state significantly lowers the bar for attackers, making a vast number of sites potentially susceptible without specific misconfigurations.
Tin Pham
Security researcher Tin Pham, also known as TF1T, is credited with the discovery and responsible disclosure of this critical flaw through the Patchstack Bug Bounty Program. Pham reported the issue to Elementor Pro on July 16, 2026, leading to a swift response from the developers. A patch, identified as version 4.2.2, was subsequently released on August 19, providing a crucial fix for the vulnerability.
This disclosure comes shortly after WordPress itself released version 7.0.4 to address another high-severity security issue, CVE-2026-65640, which also enabled remote code execution through malicious Postscript file uploads by Author-level users. The broader context of these recent vulnerabilities, including the ongoing 'StopAndProtect' operation that leverages compromised WordPress sites for malware delivery, underscores the critical importance of maintaining up-to-date websites and plugins. Users are strongly advised to apply the Elementor Pro 4.2.2 update immediately, regularly scan for unauthorized modifications, and audit their sites for unknown accounts or plugins to mitigate these persistent threats.
Key points
- A critical vulnerability (CVE-2026-32475) in Elementor Pro allows unauthenticated attackers to upload PHP files.
- The flaw, rated 9.0 CVSS, enables remote code execution on affected WordPress sites.
- It exploits a discrepancy in the Forms module's File Upload field, bypassing extension checks.
- All Elementor Pro versions prior to 4.2.2 are vulnerable, requiring only a published page with a Form widget.
- A patch (version 4.2.2) was released on August 19, 2026, following responsible disclosure by Tin Pham.
The immediate availability of a patch (version 4.2.2) for Elementor Pro means that website administrators can quickly secure their sites against this critical vulnerability. Prompt application of this update will significantly reduce the attack surface and protect numerous WordPress installations from potential compromise.
Given Elementor Pro's widespread use and the ease with which this unauthenticated remote code execution flaw can be exploited, many websites are at high risk if updates are not applied immediately. The default settings of the File Upload field make exploitation straightforward, potentially leading to a large number of compromised sites before patches are universally adopted.
