A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files to vulnerable servers. This flaw enables remote code execution (RCE), posing a severe risk to WordPress sites using the plugin. Attackers exploiting this vulnerability could gain full control over affected servers. The issue is classified as critical due to the ease of exploitation and the widespread use of Elementor Pro across WordPress installations. Website administrators are urged to update the plugin immediately to mitigate the risk. No CVE identifier is explicitly mentioned in the available content.
CVE-2026-32475 is a critical unauthenticated file upload vulnerability in Elementor Pro versions before 4.2.2, stemming from a logic flaw in the File Upload module. The module uses two separate loops for file validation and processing that handle empty filename uploads differently. The validation loop exits early when it encounters an upload part with an empty filename (reported as UPLOAD_ERR_NO_FILE by PHP), without inspecting subsequent parts. The processing loop, however, skips the empty entry and continues processing remaining parts. An attacker can exploit this by crafting a multipart HTTP upload where the first entry has an empty filename and the second contains a malicious PHP payload. The validator dismisses the request after the first part, never checking the PHP file, while the processor skips the first part and moves the malicious PHP file into the publicly accessible directory 'wp-content/uploads/elementor/forms/'. The uploaded file's name is generated using PHP's uniqid() function, which is time-based rather than random, allowing an attacker to determine the filename via timing brute-force or, in some configurations, retrieve the exact URL through an autoresponder email. Once the attacker requests the file URL, the server's PHP interpreter executes its contents with web server privileges, enabling arbitrary remote code execution. Exploitation requires only that the target site have a published Elementor form with a File Upload field and the multiple file upload option enabled (disabled by default). The vulnerability was discovered by researcher Tin Pham and reported to Patchstack on July 16. The fix was verified by Patchstack on August 3 and released the following day.
1. Update Elementor Pro to version 4.2.2 or later immediately. 2. Inspect the 'wp-content/uploads/elementor/forms/' directory for any PHP files or other unexpected/rogue files, as updating does not remove previously uploaded malicious files. 3. If malicious files are found, investigate for signs of compromise and consider a full security audit of the server. 4. Disable or remove Elementor Pro forms that have the File Upload field with the multiple file upload option enabled if patching is not immediately possible. 5. Monitor web server logs for unexpected requests to files in the 'wp-content/uploads/elementor/forms/' directory, especially PHP file access patterns. 6. Consider implementing a web application firewall (WAF) rule to block multipart uploads with empty filename entries targeting Elementor form endpoints.
PHP files present in wp-content/uploads/elementor/forms/ directory
