A critical vulnerability (CVSS 9.0) just dropped in Elementor Pro, the premium WordPress page builder plugin — and it's a bad one for anyone building or maintaining WordPress sites.
CVE-2026-32475 lets a completely unauthenticated attacker upload a malicious PHP file and achieve full remote code execution. No login. No CSRF token. Just one crafted multipart form submission through Elementor's Forms widget File Upload field.
The bug, technically
Elementor's upload handling runs files through two separate loops — one for validation, one for processing. Both loops need to decide what happens when a multipart upload has an empty filename (UPLOAD_ERR_NO_FILE). They disagree on the early-exit logic for that case.
An attacker submits two file parts under the same field: the first with an empty filename, the second a disguised PHP payload. The validation loop skips the real payload because of the empty first entry. The processing loop still saves it — straight into a public-facing directory.
Filenames are generated via uniqid(), which is time-based, not cryptographically random — making the dropped file's name guessable or extractable from autoresponder emails in some configs.
Affected / fixed
- Vulnerable: Elementor Pro ≤ 4.2.1
- Patched: Elementor Pro 4.2.2 (Aug 19, 2026)
If you manage WordPress sites
wp plugin list --name=elementor-pro --field=version
find wp-content/uploads/elementor/forms -name "*.php"
Run these across every site you manage. Today, not next sprint.
Full breakdown with exploit mechanics, IOCs, and log-hunting commands:
https://www.xpert4cyber.com/2026/08/elementor-pro-rce-vulnerability.html
Top comments (0)