A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.
Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently.
“The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem.
“The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.”
An attacker could exploit this behavior by crafting a multipart upload in which the first entry has an empty filename, followed by a malicious PHP payload.
This causes the validation routine to exit after examining the first part, dismissing it with the UPLOAD_ERR_NO_FILE error and never checking the second part. The processing step skips the empty entry but goes through the rest of the upload and moves to a public directory (wp-content/uploads/elementor/forms/) the PHP in the second part.
Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has more than 10 million active installs.
The Pro version adds more advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, and is generally used by higher-grade platforms.
According to Patchstack, exploiting CVE-2026-32475 requires only that the target site have a published Elementor form containing a File Upload field.
The researchers say that after uploading the malicious PHP, an attacker can determine its filename in the public directory because it is created using the uniqid() function, which is not random but time-based.
An attacker could determine the name of the payload through a timing brute-force. In some configurations, they can obtain its exact URL through an autoresponder email.
Once the attacker requests the uploaded file at that URL, the server’s PHP interpreter executes its contents, allowing arbitrary code to run with the privileges of the web server.
Patchstack learned of CVE-2026-32475 on July 16 from Tin Pham, the researcher who discovered it, and shared the information with the Elementor team.
The next day, the plugin developer prepared a fix, which Patchstack verified on August 3, and delivered it yesterday.
“Every other Elementor site is unaffected, however we still recommend all sites update to the latest version to reduce the likelihood of security and incompatibility issues,” the vendor says.
Administrators should update to the latest Elementor Pro release and check the ‘wp-content/uploads/elementor/forms/’ directory for PHP files or other rogue files.
Patchstack notes that updating does not remove malicious files uploaded during the exposure period and recommends a thorough examination.
At this time, no cases of active exploitation have been observed in the wild.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Critical Zimbra RCE flaw now actively exploited in attacks
WordPress membership plugin bug exploited to create admin accounts
Max severity SAP Commerce Cloud flaw now targeted in attacks
Critical VMware vCenter RCE flaw exploited for reverse SSH access
TP-Link patches Omada ZTP flaws allowing hackers to breach networks
Microsoft starts removing WMIC tool used by cybercriminals
Microsoft confirms outage affecting search in Microsoft 365 apps
CISA: Windows Task Host flaw now exploited by ransomware gangs
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
Certighost CVE is new. The privilege behind it isn’t. Discover where yours is hiding.
See how AI is reshaping email attacks. Download the 2026 Kaseya Email Security Report.
Signature-based prevention fell to 50%. See what your controls still stop.
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
