A critical security vulnerability in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload malicious files and execute arbitrary code on vulnerable websites.
Tracked as CVE-2026-32475, the flaw affects Elementor Pro versions earlier than 4.2.2. The vulnerability is located in the plugin’s file upload functionality, which uses separate loops to validate and process uploaded files. These loops handle uploads with empty filenames differently.
“The problem is that these two loops can’t agree on what to do with empty file entries (upload parts with blank filenames, reported by PHP as UPLOAD_ERR_NO_FILE),” Patchstack reported, a cybersecurity company focused on the WordPress ecosystem.
The validation and processing routines use different early-exit rules for empty upload entries. As a result, a specially crafted multipart request can bypass file validation while still allowing the malicious file to be processed and stored.
An attacker could exploit the issue by placing an empty filename as the first part of a multipart upload, followed by a malicious PHP file.
The validation routine stops after encountering the first part because PHP reports it with the UPLOAD_ERR_NO_FILE error. The subsequent malicious file is therefore not inspected. During processing, however, the empty entry is skipped and the remaining upload is saved to the publicly accessible wp-content/uploads/elementor/forms/ directory.
Elementor Pro is the paid edition of Elementor, a widely used drag-and-drop WordPress website builder with 10 million active installations.
The Pro plugin includes advanced features such as form building, theme and popup builders, custom code and CSS tools, and e-commerce functionality. It is commonly deployed on business and high-traffic WordPress websites.
According to Patchstack, exploitation of CVE-2026-32475 requires a website to have a published Elementor form containing a file upload field. The risk is limited to forms where the multiple-file upload option is enabled, which is disabled by default.
After uploading a malicious PHP file, an attacker must identify its filename before requesting it. Patchstack researchers said the filename is generated with PHP’s uniqid() function, which is based on time rather than strong randomization.
Attackers may be able to determine the uploaded filename through timing-based brute-force techniques. In some configurations, an autoresponder email may also reveal the exact URL of the uploaded file.
Once the malicious file is accessed, the server’s PHP interpreter may execute it with the privileges of the web server, potentially allowing the attacker to run arbitrary commands, access sensitive data, or compromise the WordPress installation.
Patchstack received details about CVE-2026-32475 from security researcher Tin Pham on July 16 and shared the report with Elementor. The developer prepared a fix the following day, and Patchstack verified the update on August 3.
Elementor warned that only websites using an Elementor Pro form with a file upload field and the multiple-file upload option enabled are affected.
“All other Elementor sites are unaffected, but we recommend updating all sites to the latest version to reduce the chance of security and incompatibility issues,” the vendor said.
WordPress administrators should update Elementor Pro to the latest available version immediately. They should also inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other suspicious content.
Because updating the plugin does not remove files uploaded before the security fix was installed, administrators should review existing files and investigate any signs of compromise. Patchstack also recommends testing websites after applying the update.
No active exploitation of CVE-2026-32475 has been observed in the wild at this time.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com