Full Report
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. "The flaw lives in the Forms module's File
Analysis Summary
# Vulnerability: Elementor Pro Unauthenticated Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-32475
- **CVSS Score:** 9.0 (Critical)
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
- **Products:** Elementor Pro WordPress Plugin
- **Versions:** All versions up to and including 4.2.1
- **Configurations:** Any site with at least one published Elementor page containing a "Form" widget that has a "File Upload" field enabled (default configuration).
## Vulnerability Description
The vulnerability exists within the Forms module's File Upload functionality. A logic flaw occurs because the plugin processes file extension validation and the file-moving operation in two separate loops. When multiple file parts are submitted for the same field, the loop responsible for blocklist validation can be bypassed if empty file entries are handled inconsistently. This allows an unauthenticated attacker to skip security checks and write a PHP file directly into a public directory.
## Exploitation
- **Status:** PoC details disclosed; vulnerability reported via bug bounty program.
- **Complexity:** Low (Requires no authentication; default settings are vulnerable).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to server files and database).
- **Integrity:** High (Ability to modify site content and system files).
- **Availability:** High (Potential for site takeover or deletion).
## Remediation
### Patches
- **Version 4.2.2:** Released on August 19, 2026. Users should update immediately to this version or higher.
### Workarounds
- **Disable File Uploads:** Temporarily remove or disable the "File Upload" field from all Elementor Forms if patching is not immediately possible.
- **Set Fields to Required:** While the default "Required" toggle is off, ensuring fields are properly validated may offer slight friction, though patching remains the only definitive fix.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected PHP files in the directory: `wp-content/uploads/elementor/forms/`
- Files in this directory typically follow the naming convention: `[random_unique_id].php`
- **Detection Methods:**
- Monitor web server logs for POST requests to pages containing Elementor forms followed by unusual PHP execution in the uploads directory.
- Use security scanners to audit the `wp-content` directory for unauthorized executable files.
## References
- **Vendor Advisory:** hxxps[://]patchstack[.]com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/
- **CVE Record:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-32475
- **Original News Source:** hxxps[://]thehackernews[.]com/2026/08/elementor-pro-flaw-could-let.html