Elementor Pro Flaw Allows Unauthenticated PHP Upload and Remote Code Execution
Summary
CVE-2026-32475 lets unauthenticated attackers bypass Elementor Pro’s file-extension checks to upload PHP and potentially execute code on affected WordPress sites. Version 4.2.2 fixes the flaw; the article also covers a separate WordPress core issue.
Key points
- CVE-2026-32475 affects Elementor Pro versions through 4.2.1 and carries a CVSS score of 9.0.
- Patchstack says an unauthenticated attacker can bypass the Forms module’s extension checks by submitting two file parts for the same upload field.
- The flaw can place a PHP file in a public uploads directory, potentially enabling remote code execution; exploitation requires a published Elementor page with a Form widget containing a File Upload field.
- Elementor Pro 4.2.2, released August 19, 2026, fixes the flaw. Researcher Tin Pham, also known as TF1T, reported it.
- WordPress 7.0.4 addresses CVE-2026-65640, which can enable code execution through a malicious Postscript upload; the article says exploitation requires Imagick and Ghostscript plus a user with the upload_files capability.
- The article says the StopAndProtect operation is using thousands of compromised WordPress sites for malware delivery, command-and-control communications, and stolen-data storage.
- WordPress users are advised to update sites and plugins, check for unauthorized modifications and unexpected redirects or pop-ups, and audit for unknown accounts and plugins.
Article Details
- Vulnerability Types
- Unrestricted upload of files with dangerous types
- Remote code execution
- Severity
- Critical (CVSS 9.0/10.0) for CVE-2026-32475; high (CVSS 8.8) for CVE-2026-65640
- Affected Versions
- Elementor Pro versions up to and including 4.2.1
- WordPress versions 4.7 through 7.0
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-32475Researchers disclosed a critical flaw in Elementor Pro, tracked as CVE-2026-32475, that can let an unauthenticated attacker upload a PHP file and achieve remote code execution on WordPress sites running versions up toCVE-2026-65640comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an
People
Products
Elementor Pro for WordPressResearchers disclosed a critical flaw in Elementor Pro, tracked as CVE-2026-32475, that can let an unauthenticated attacker upload a PHP file and achieve remote code execution on WordPress sites running versions up toGhostscriptImagick and Ghostscript in use on the server, given the issue is in Ghostscript’s handling of certain embedded filesImagickImagick and Ghostscript in use on the server, given the issue is in Ghostscript’s handling of certain embedded filesWordPressthat can let an unauthenticated attacker upload a PHP file and achieve remote code execution on WordPress sites running versions up to 4.2.1.