Critical WordPress Plugin Bug Exposes Sites to Remote Code Execution

Key Takeaways

• A critical vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files.
• This flaw can lead to remote code execution (RCE) on affected WordPress sites.
• Versions of Elementor Pro up to and including 4.2.1 are vulnerable; version 4.2.2 contains the fix.
• Exploitation requires a publicly accessible Elementor Pro Forms widget with a File Upload field, and potentially the “multiple file upload” option enabled.

A severe security vulnerability has been identified in the Elementor Pro WordPress plugin, potentially exposing websites to remote code execution (RCE) by unauthenticated attackers. The flaw, designated as CVE-2026-32475, permits the upload of arbitrary malicious PHP files, which can then be executed on the server.

The vulnerability impacts Elementor Pro versions up to and including 4.2.1. Users are urged to update immediately to version 4.2.2 or newer, where the issue has been resolved.

Understanding the Vulnerability

Elementor Pro, a premium add-on for the popular Elementor page builder, includes a “Forms” widget that allows website administrators to create various interactive forms, such as contact forms or document submission portals. A key feature within these forms is the “File Upload” field, which enables visitors to attach files.

The core of the vulnerability lies in a logical error within how the plugin processes file uploads. Specifically, the routines responsible for validating file extensions and those for storing the files operate in separate loops. Under normal circumstances, Elementor Pro employs both an allowlist and a blocklist to ensure that dangerous file extensions, like .php, .phtml, .asp, or .exe, are prevented from being uploaded.

Exploitation Mechanism

Security researcher Tin Pham (TF1T), who reported the flaw via Patchstack, discovered that these two distinct processing loops handle empty upload entries inconsistently. An attacker can exploit this by submitting multiple file parts for a single upload field. By placing an empty file entry first, followed by a malicious PHP file, the validation routine prematurely terminates upon encountering the empty entry.

Crucially, this means the validation process never scrutinizes the subsequent PHP file. Conversely, the file-processing routine bypasses the initial empty entry and proceeds to save the malicious PHP file to the server. This allows the attacker to embed a PHP payload within the publicly accessible Elementor forms upload directory.

If this uploaded file is subsequently accessed via a web browser, the web server may execute the embedded PHP code. This grants the attacker remote code execution capabilities with the permissions of the web server process, all without requiring any WordPress account, administrative credentials, or direct administrator interaction. The primary prerequisite for this attack is a publicly available Elementor Pro Forms widget that incorporates a File Upload field.

Elementor has clarified that the “multiple file upload” option must also be enabled within the form for this specific attack vector to succeed, though this option is disabled by default. Nonetheless, the critical nature of the flaw necessitates immediate action for all potentially exposed sites.

The Fix and Post-Patch Actions

Version 4.2.2 of Elementor Pro addresses the vulnerability by synchronizing the file validation and processing behaviors. It also implements more robust validation checks closer to the actual file-moving process. However, simply updating the plugin may not be sufficient for sites that have already been compromised.

Patchstack, after receiving the report, published mitigation rules for its customers while Elementor prepared and released its security update on August 19, 2026. While no active exploitation has been publicly confirmed at the time of reporting, the unauthenticated nature and severity of this flaw underscore the urgency of patching.

What You Should Do

• Update Immediately: Ensure Elementor Pro is updated to version 4.2.2 or later without delay.
• Inspect Upload Directories: Thoroughly examine the wp-content/uploads/elementor/forms/ directory for any unexpected or suspicious PHP files, or other executable content. Treat any anomalies as potential indicators of compromise and investigate before removal.
• Review Public Forms: Audit all public-facing Elementor Pro Forms. Disable any unnecessary file upload functionality.
• Restrict File Types: Where file uploads are essential, strictly limit accepted file types to only those absolutely required (e.g., PDFs, specific image formats).
• Prevent PHP Execution: Implement measures to prevent PHP execution within WordPress upload directories. This can often be achieved through web server configurations (e.g., .htaccess rules for Apache, Nginx configuration directives).

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.