Full Report
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. [...]
Analysis Summary
This summary provides a technical overview of CVE-2026-32475 based on the provided vulnerability report.
# Vulnerability: Unauthenticated Remote Code Execution in Elementor Pro
## CVE Details
- **CVE ID:** CVE-2026-32475
- **CVSS Score:** 9.8 (Critical) - *Estimated based on unauthenticated RCE impact*
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type) / CWE-691 (Insufficient Control Flow Management)
## Affected Systems
- **Products:** Elementor Pro (Paid version)
- **Versions:** All versions prior to 4.2.2
- **Configurations:** Sites are vulnerable if they have a published Elementor Form containing a **File Upload field** with the **"Multiple File Upload"** option enabled.
## Vulnerability Description
The flaw exists in the File Upload module due to an inconsistency between the file validation loop and the file processing loop. When handling multipart uploads, PHP reports empty filenames as `UPLOAD_ERR_NO_FILE`.
The validation loop exits early when it encounters an empty entry, failing to inspect subsequent parts of the upload. However, the processing (mover) loop skips the empty entry but continues to process and move the subsequent malicious files to a publicly accessible directory (`/wp-content/uploads/elementor/forms/`). This allows an attacker to bypass file type restrictions and upload executable PHP scripts.
## Exploitation
- **Status:** PoC available (detailed in research); No active exploitation observed in the wild at the time of the report.
- **Complexity:** Low (Requires timing brute-force or autoresponder intercept to determine the final filename).
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Full access to server data and database)
- **Integrity:** High (Ability to modify site content, plant backdoors, or deface)
- **Availability:** High (Ability to delete files or crash the service)
## Remediation
### Patches
- **Elementor Pro 4.2.2:** Users should update to version 4.2.2 or later immediately to resolve the logic flaw in the upload handler.
### Workarounds
- **Disable File Uploads:** Temporarily remove "File Upload" fields from all active Elementor forms.
- **Disable Multiple Uploads:** Ensure the "Multiple File Upload" toggle is turned off in form settings.
- **Web Application Firewall (WAF):** Implement rules to block multipart/form-data uploads containing `.php` extensions or suspicious null/empty filename headers directed at Elementor form endpoints.
## Detection
- **Indicators of Compromise (IoC):** Presence of `.php` files or other executable scripts within the `wp-content/uploads/elementor/forms/` directory.
- **Detection Methods:**
- Monitor server logs for repeated requests to the `wp-content/uploads/elementor/forms/` directory following a POST request to a page containing a form.
- Check for file creation patterns using `uniqid()` (time-based) in the uploads directory.
- Audit autoresponder email logs for sent links containing PHP file paths.
## References
- **Vendor Advisory:** hxxps[://]elementor[.]com/ (Check internal subscriber notifications)
- **Patchstack Research:** hxxp[://]patchstack[.]com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/
- **Original News Source:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/