Critical Elementor Pro bug exposes WordPress sites to RCE attacks

A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.

Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently.

“The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem.

“The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.”

An attacker could exploit this behavior by crafting a multipart upload in which the first entry has an empty filename, followed by a malicious PHP payload.

This causes the validation routine to exit after examining the first part, dismissing it with the UPLOAD_ERR_NO_FILE error and never checking the second part. The processing step skips the empty entry but goes through the rest of the upload and moves to a public directory (wp-content/uploads/elementor/forms/) the PHP in the second part.

Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has more than 10 million active installs.

The Pro version adds more advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, and is generally used by higher-grade platforms.

According to Patchstack, exploiting CVE-2026-32475 requires only that the target site have a published Elementor form containing a File Upload field.

The researchers say that after uploading the malicious PHP, an attacker can determine its filename in the public directory because it is created using the uniqid() function, which is not random but time-based.

An attacker could determine the name of the payload through a timing brute-force. In some configurations, they can obtain its exact URL through an autoresponder email.

Once the attacker requests the uploaded file at that URL, the server’s PHP interpreter executes its contents, allowing arbitrary code to run with the privileges of the web server.

Patchstack learned of CVE-2026-32475 on July 16 from Tin Pham, the researcher who discovered it, and shared the information with the Elementor team.

The next day, the plugin developer prepared a fix, which Patchstack verified on August 3, and delivered it yesterday.

Elementor has also notified its subscribers of the vulnerability, noting that it puts at risk only "websites that use an Elementor Pro Form with an upload file form field, and the multiple file upload option enabled (it is disabled by default)."

"Every other Elementor site is unaffected, however we still recommend all sites update to the latest version to reduce the likelihood of security and incompatibility issues," the vendor says.

Administrators should update to the latest Elementor Pro release and check the ‘wp-content/uploads/elementor/forms/’ directory for PHP files or other rogue files.

Patchstack notes that updating does not remove malicious files uploaded during the exposure period and recommends a thorough examination.

At this time, no cases of active exploitation have been observed in the wild.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report