Elementor Pro flaw lets attackers run code on WordPress sites
▼ Summary
– A critical vulnerability, CVE-2026-32475, in Elementor Pro versions before 4.2.2 allows attackers to upload executable files for remote code execution via the File Upload module.
– The flaw arises from conflicting validation and processing loops for empty filename uploads, enabling a crafted multipart upload to bypass validation and move a malicious PHP payload to a public directory.
– Exploitation requires a published Elementor form with a File Upload field; the attacker can guess the uploaded file’s name via timing-based brute force or obtain it through an autoresponder email.
– The fix was prepared by Elementor on July 17, verified by Patchstack on August 3, and released; only sites using a form with multiple file upload enabled (disabled by default) are at risk.
– Administrators should update to the latest Elementor Pro and inspect the ‘wp-content/uploads/elementor/forms/’ directory for rogue files, as updating does not remove previously uploaded malicious content; no active exploitation has been observed yet.
A critical security flaw has been discovered in the Elementor Pro WordPress plugin, one that could let attackers upload malicious files and execute arbitrary code on affected servers. The vulnerability, tracked as CVE-2026-32475, impacts all versions of the plugin released before 4.2.2.
The root cause lies in the plugin’s File Upload module, specifically in how it handles two separate loops for validating and processing uploaded files. These loops treat empty filename entries differently, creating a logic gap that can be exploited.
According to a technical breakdown from Patchstack, a security firm specializing in the WordPress ecosystem, the core issue is a disagreement between the two loops regarding empty file entries. When PHP reports an upload part with a blank filename as `UPLOADERRNO_FILE`, the validation loop and the processing loop exit early under different conditions. This discrepancy allows a carefully crafted multipart upload to be interpreted one way by the validator and another way by the mover.
An attacker can take advantage of this by sending a multipart upload where the first entry has an empty filename, followed by a second entry containing a malicious PHP payload. The validation routine exits after inspecting the first part, dismissing it with the `UPLOADERRNO_FILE` error and never checking the second part. Meanwhile, the processing step skips the empty entry but continues through the rest of the upload, moving the PHP file from the second part to a public directory at `wp-content/uploads/elementor/forms/`.
Elementor Pro is the premium tier of Elementor, one of the most widely used drag-and-drop website builders for WordPress, with over 10 million active installations. The paid version adds advanced capabilities such as form building, theme and popup constructors, custom code and CSS support, and e-commerce tools, making it a common choice for more sophisticated websites.
Patchstack notes that exploiting this flaw requires only that the target site has a published Elementor form with a File Upload field. After the malicious PHP file is uploaded, an attacker can deduce its filename because it is generated using the `uniqid()` function, which is time-based rather than random. A timing brute-force attack can reveal the payload’s name, and in certain configurations, an autoresponder email may even expose its exact URL.
Once the attacker requests the uploaded file at that URL, the server’s PHP interpreter runs its contents, enabling arbitrary code execution with the web server’s privileges.
The discovery timeline shows a coordinated response. Patchstack learned of the issue on July 16 from researcher Tin Pham, who found the bug. The Elementor team prepared a fix the following day, Patchstack verified it on August 3, and the update was delivered yesterday.
Elementor has informed its subscribers about the vulnerability, clarifying that only sites using an Elementor Pro Form with an upload file field and the multiple file upload option enabled are at risk, and that option is off by default. The vendor states that all other Elementor sites are unaffected, but still recommends updating to the latest version to minimize security and compatibility risks.
Administrators are urged to update to the newest Elementor Pro release immediately and to inspect the `wp-content/uploads/elementor/forms/` directory for any PHP files or other suspicious content. Patchstack warns that updating alone will not remove files uploaded during the exposure window, so a thorough examination is essential.
As of now, there are no reports of active exploitation in the wild.
(Source: BleepingComputer)
