Critical Elementor Pro bug exposes WordPress sites to RCE attacks

Summary

A critical vulnerability (CVE-2026-32475) in Elementor Pro for WordPress allows attackers to upload executable files for remote code execution. The flaw stems from how the File Upload module handles empty filenames, enabling attackers to bypass validation and upload malicious PHP payloads to public directories. Exploitation requires a site to have an Elementor form with a File Upload field and the multiple file upload option enabled.

Full text

Critical Elementor Pro bug exposes WordPress sites to RCE attacks By Bill Toulas August 20, 2026 10:39 AM 0 A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently. “The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem. “The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.” An attacker could exploit this behavior by crafting a multipart upload in which the first entry has an empty filename, followed by a malicious PHP payload. This causes the validation routine to exit after examining the first part, dismissing it with the UPLOAD_ERR_NO_FILE error and never checking the second part. The processing step skips the empty entry but goes through the rest of the upload and moves to a public directory (wp-content/uploads/elementor/forms/) the PHP in the second part. Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has more than 10 million active installs. The Pro version adds more advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, and is generally used by higher-grade platforms. According to Patchstack, exploiting CVE-2026-32475 requires only that the target site have a published Elementor form containing a File Upload field. The researchers say that after uploading the malicious PHP, an attacker can determine its filename in the public directory because it is created using the uniqid() function, which is not random but time-based. An attacker could determine the name of the payload through a timing brute-force. In some configurations, they can obtain its exact URL through an autoresponder email. Once the attacker requests the uploaded file at that URL, the server’s PHP interpreter executes its contents, allowing arbitrary code to run with the privileges of the web server. Patchstack learned of CVE-2026-32475 on July 16 from Tin Pham, the researcher who discovered it, and shared the information with the Elementor team. The next day, the plugin developer prepared a fix, which Patchstack verified on August 3, and delivered it yesterday. Elementor has also notified its subscribers of the vulnerability, noting that it puts at risk only "websites that use an Elementor Pro Form with an upload file form field, and the multiple file upload option enabled (it is disabled by default)." "Every other Elementor site is unaffected, however we still recommend all sites update to the latest version to reduce the likelihood of security and incompatibility issues," the vendor says. Administrators should update to the latest Elementor Pro release and check the ‘wp-content/uploads/elementor/forms/’ directory for PHP files or other rogue files. Patchstack notes that updating does not remove malicious files uploaded during the exposure period and recommends a thorough examination. At this time, no cases of active exploitation have been observed in the wild. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical Zimbra RCE flaw now actively exploited in attacksWordPress membership plugin bug exploited to create admin accountsMax severity SAP Commerce Cloud flaw now targeted in attacksCritical VMware vCenter RCE flaw exploited for reverse SSH accessTP-Link patches Omada ZTP flaws allowing hackers to breach networks

Indicators of Compromise

• cve — CVE-2026-32475

Entities