Critical Zero-Day Vulnerability in Elementor Pro Plugin Enables Remote Code Execution
A severe security flaw in Elementor Pro, a premium WordPress plugin, has been disclosed, allowing unauthenticated attackers to upload malicious PHP files and execute arbitrary code on vulnerable servers. Tracked as CVE-2026-32475, the vulnerability affects all versions up to and including 4.2.1, with a patch released in version 4.2.2.
The issue stems from a logic flaw in the plugin’s File Upload functionality within the Forms widget, which is commonly used for contact forms, document submissions, and other user-upload scenarios. While Elementor Pro employs allowlists and blocklists to restrict dangerous file extensions (e.g., .php, .phtml, .exe), the validation and file-processing routines operate in separate loops creating a critical gap.
Attackers can exploit this by submitting multiple file parts in a single upload field, placing an empty entry first followed by a malicious PHP file. The validation loop halts upon encountering the empty entry, bypassing checks on the subsequent file. Meanwhile, the file-processing loop skips the empty entry and saves the malicious payload, which can then be executed if accessed via a browser, granting remote code execution (RCE) with the web server’s permissions.
Key details of the vulnerability:
- Affected versions: Elementor Pro ≤4.2.1
- Fixed version: 4.2.2 (released August 19, 2026)
- Attack vector: Unauthenticated exploitation via publicly accessible File Upload fields in Elementor Pro forms
- Prerequisite: The multiple file upload option must be enabled (disabled by default)
- Discovery: Security researcher Tin Pham (TF1T), reported via Patchstack
The patch aligns validation and processing behavior, introducing stricter checks closer to the file-moving stage. However, administrators are advised to inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP or executable files, which may indicate compromise. While no active exploitation was observed at the time of disclosure, the flaw’s unauthenticated nature heightens the risk, making immediate updates critical.
Source: https://cybersecuritynews.com/wordpress-plugin-vulnerability-exposes-3/
Elementor cybersecurity rating report: https://www.rankiteo.com/company/elementor
"id": "ELE1787322520",
"linkid": "elementor",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'All users of Elementor Pro '
'≤4.2.1',
'industry': 'Web Development',
'name': 'Elementor Pro (WordPress Plugin)',
'type': 'Software'}],
'attack_vector': 'Unauthenticated exploitation via publicly accessible File '
'Upload fields in Elementor Pro forms',
'customer_advisories': 'Update to Elementor Pro 4.2.2 or later; inspect '
'upload directories for malicious files.',
'data_breach': {'file_types_exposed': ['PHP']},
'date_publicly_disclosed': '2026-08-19',
'date_resolved': '2026-08-19',
'description': 'A severe security flaw in Elementor Pro, a premium WordPress '
'plugin, has been disclosed, allowing unauthenticated '
'attackers to upload malicious PHP files and execute arbitrary '
'code on vulnerable servers. The vulnerability, tracked as '
'CVE-2026-32475, affects all versions up to and including '
'4.2.1, with a patch released in version 4.2.2. The issue '
'stems from a logic flaw in the plugin’s File Upload '
'functionality within the Forms widget, which is commonly used '
'for contact forms, document submissions, and other '
'user-upload scenarios. Attackers can exploit this by '
'submitting multiple file parts in a single upload field, '
'bypassing validation checks and uploading malicious PHP '
'files.',
'impact': {'operational_impact': 'Remote code execution (RCE) with web server '
'permissions',
'systems_affected': 'WordPress websites using Elementor Pro '
'≤4.2.1'},
'investigation_status': 'Patched',
'post_incident_analysis': {'corrective_actions': 'Alignment of validation and '
'processing behavior; '
'stricter checks closer to '
'file-moving stage',
'root_causes': 'Logic flaw in file upload '
'validation and processing '
'routines'},
'recommendations': 'Immediately update to Elementor Pro 4.2.2 or later; '
'disable multiple file upload if not needed; inspect '
'upload directories for malicious files.',
'references': [{'source': 'Patchstack'}],
'response': {'containment_measures': 'Patch released in version 4.2.2',
'remediation_measures': 'Update to Elementor Pro 4.2.2 or later; '
'inspect '
'`wp-content/uploads/elementor/forms/` '
'for malicious files',
'third_party_assistance': 'Patchstack'},
'title': 'Critical Zero-Day Vulnerability in Elementor Pro Plugin Enables '
'Remote Code Execution',
'type': 'Zero-Day Vulnerability',
'vulnerability_exploited': 'CVE-2026-32475'}