Critical Elementor Pro Flaw Enables Remote Code Execution on Vulnerable WordPress Sites
Summary
CVE-2026-32475 affects Elementor Pro versions before 4.2.2 on sites with a published form, File Upload field and multiple uploads enabled. A crafted upload can place executable PHP on the server; administrators should update and check for rogue files.
Key points
- CVE-2026-32475 affects Elementor Pro versions before 4.2.2; the described exposure requires a published form with a File Upload field and multiple file uploads enabled.
- Patchstack says validation and processing handle empty-filename upload parts differently, allowing a crafted multipart request to bypass validation.
- The malicious PHP payload can be moved to a public uploads directory and executed by the server when requested.
- Patchstack says the payload filename, generated with time-based uniqid(), may be found through timing brute force or, in some configurations, an autoresponder email.
- Administrators should update Elementor Pro and inspect wp-content/uploads/elementor/forms/ for rogue files; updating does not remove files uploaded earlier.
- No active exploitation had been observed at the time of the report.
Article Details
- Vulnerability Types
- Arbitrary file upload leading to remote code execution
- Severity
- Critical
- Affected Versions
- Elementor Pro versions before 4.2.2
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
People
Vendors
Products
Elementor Pro for WordPressA critical flaw in Elementor Pro, tracked as CVE-2026-32475, can let attackers upload a malicious PHP file and achieve remote code execution on vulnerable WordPress servers.WordPressA critical flaw in Elementor Pro, tracked as CVE-2026-32475, can let attackers upload a malicious PHP file and achieve remote code execution on vulnerable WordPress servers.