Full Report
A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. [...]
Analysis Summary
# Vulnerability: Critical RCE in Elementor Pro via File Upload Bypass
## CVE Details
- **CVE ID:** CVE-2026-32475
- **CVSS Score:** 9.8 (Critical) *(Note: Based on typical RCE severity for this class of flaw)*
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type) / Faulty Validation of File-Upload Arrays
## Affected Systems
- **Products:** Elementor Pro (WordPress Plugin)
- **Versions:** 4.2.1 and all earlier versions.
- **Configurations:** Sites are vulnerable only if they have a published **Elementor Pro Form widget** containing at least one **File Upload field**.
## Vulnerability Description
The vulnerability exists due to faulty validation logic when handling file-upload arrays in Elementor Pro forms. An attacker can bypass security checks by submitting a specially crafted array where the first element is empty and the second element contains a malicious PHP payload. The plugin fails to validate subsequent files after encountering the empty first element, allowing the PHP file to be uploaded to the server.
## Exploitation
- **Status:** Actively exploited in the wild (Reported since August 19, 2026).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **PoC Availability:** Publicly documented (Method involves array manipulation in multipart form-data).
## Impact
- **Confidentiality:** High (Full access to site data and server files)
- **Integrity:** High (Ability to modify site content, inject webshells, and alter the database)
- **Availability:** High (Potential for site deletion, ransomware, or server shutdown)
## Remediation
### Patches
- **Elementor Pro 4.2.2**: This version addresses the validation flaw. Users should upgrade immediately.
### Workarounds
- **Disable Form Uploads:** If an immediate update is not possible, remove or disable any Elementor Pro Form widgets that utilize the "File Upload" field.
## Detection
- **Indicators of Compromise (IoC):**
- Presence of unexpected `.php` files in the directory: `hxxps[://]example[.]com/wp-content/uploads/elementor/forms/`
- Randomly generated filenames with `.php` extensions in the uploads folder.
- **Detection methods:**
- Review web server access logs for `POST` requests to pages containing Elementor forms followed by immediate `GET` requests to the `/wp-content/uploads/elementor/forms/` directory.
- Use security scanners like Wordfence or Patchstack to identify exploitation attempts.
## References
- **Vendor Advisory:** hxxps[://]elementor[.]com/
- **Wordfence Research:** hxxps[://]www[.]wordfence[.]com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-elementor-pro-plugin/
- **Patchstack Advisory:** hxxps[://]patchstack[.]com/
- **Original Report:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/critical-elementor-pro-flaw-exploited-to-take-over-wordpress-sites/