Critical Elementor Pro Vulnerability Opens the Door to Unauthenticated Code Execution

Researchers at Patchstack have disclosed the details of a critical vulnerability in the Elementor Pro plugin for WordPress. The flaw, assigned the identifier CVE-2026-32475 and rated 9.0 out of 10 on the CVSS scale, falls into the class of unrestricted upload of files of a dangerous type and, if exploited successfully, leads to remote code execution.

How the attack works

The problem lies in the file upload field of the Forms module. According to Patchstack's description, extension validation and file relocation are carried out in two separate loops that handle empty entries differently. By submitting two file parts for the same field, an attacker completely bypasses the extension blacklist and writes a PHP file into a public directory. It is precisely this discrepancy that turns a seemingly restricted upload field into a primitive for code execution without any authentication whatsoever.

The file is saved to the path wp-content/uploads/elementor/forms/<uniqid>.php, where <uniqid> is the output of PHP's uniqid() function.

Why it puts so many sites at risk

The only prerequisite for the attack is that the site has at least one published Elementor page with a form widget containing a file upload field. As the researchers note, this is an everyday and extremely common configuration: job application forms, “attach a photo, document, or receipt” fields, attachments to support tickets. What's more, the “Required field” toggle is off by default, so no special or hardened settings are needed.

The vulnerability affects all versions of the plugin up to and including 4.2.1. The discovery is credited to researcher Tin Pham (TF1T), who reported the issue through the Patchstack Bug Bounty program. The developers were notified of the bug on July 16, 2026, and the fix in version 4.2.2 was released on August 19.

Against the backdrop of other WordPress issues

The news came just over a week after the release of WordPress 7.0.4, which closes the high-severity vulnerability CVE-2026-65640 (CVSS 8.8). It allowed a user at the Author level and above to achieve code execution by uploading a malicious PostScript file, but only when Imagick and Ghostscript were in use on the server. The update changes the way uploaded media is passed to ImageMagick.

In parallel, researchers described the large-scale StopAndProtect operation, which turns thousands of compromised WordPress sites into distributed infrastructure for delivering malware, communicating with command servers, and storing stolen data. Users are advised to keep their sites and plugins updated in a timely manner, check them for unauthorized changes, and audit them for unknown accounts.

Source: The Hacker News