A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files and achieve remote code execution on affected servers. The flaw, tracked as CVE-2026-32475, impacts Elementor Pro versions prior to 4.2.2 and originates in the File Upload module. According to cybersecurity firm Patchstack, the module uses separate loops for file validation and processing that handle empty filename uploads differently, creating a logic gap attackers can exploit.
The issue arises because the validation and processing loops have different early-exit logic for empty file entries, which PHP reports as upload errors. An attacker can craft a multipart upload where the first entry has a blank filename and the second contains a malicious PHP payload. The validation routine stops after dismissing the empty first part, while the processing step skips that entry but continues to move the PHP file to a public directory under wp-content/uploads/elementor/forms/.
Elementor Pro is the paid tier of Elementor, a widely used drag-and-drop website builder for WordPress with more than 10 million active installations. The Pro version adds advanced features such as form creation, theme and popup builders, custom code, and e-commerce tools, and is commonly deployed on higher-grade platforms. Patchstack reports that exploiting this vulnerability only requires a published Elementor form with a File Upload field on the target site.
After uploading the malicious PHP file, an attacker can determine its filename because the system uses the uniqid() function, which is time-based rather than random. This allows for a timing brute-force to guess the payload's location, and in certain configurations, an autoresponder email may reveal the exact URL. Once the attacker requests the file, the server's PHP interpreter executes its contents, granting arbitrary code execution with web server privileges.
Patchstack learned of the vulnerability on July 16 from researcher Tin Pham and shared the details with the Elementor team. The developer prepared a fix the next day, which Patchstack verified on August 3, and the update was delivered yesterday. The vendor stated that other Elementor sites are unaffected but still recommends all users update to the latest version to minimize security and compatibility risks.
Administrators are advised to update to the latest Elementor Pro release and review the wp-content/uploads/elementor/forms/ directory for any PHP or rogue files. Patchstack notes that updating does not remove malicious files uploaded during the exposure period, so a thorough examination is necessary. As of now, no active exploitation of this vulnerability has been observed in the wild.
More cybersecurity news from TechManNews.
