Meta News

A newly disclosed vulnerability in Elementor Pro exposes WordPress websites to remote code execution through a flaw in the plugin’s file-upload functionality. The weakness is particularly serious because exploitation does not require authentication: an attacker only needs to find a site containing a relatively common Elementor form configuration.

Tracked as CVE-2026-32475, the vulnerability carries a CVSS score of 9.0 and affects Elementor Pro versions up to and including 4.2.1. Elementor released version 4.2.2 on August 19 to address the issue after security researcher Tin Pham reported it through Patchstack’s bug bounty program on July 16.

The vulnerability resides in the File Upload field provided by Elementor Pro’s Forms module. Normally, the plugin checks uploaded files to prevent users from submitting dangerous formats such as executable PHP scripts.

The problem is that Elementor performs extension validation and the subsequent movement of uploaded files using two separate processing loops. Those loops handle empty file entries differently.

According to Patchstack’s analysis, an attacker can submit two file parts for the same form field in a way that causes Elementor to bypass its extension blocklist. The malicious PHP file is then moved into a publicly accessible WordPress uploads directory.

Once the PHP file exists somewhere the web server can execute it, the attacker can request that file directly and execute arbitrary PHP code.

What begins as a validation bug therefore becomes a remote code execution primitive.

The attack has only one important prerequisite: the targeted website must contain at least one published Elementor page using a Form widget with a File Upload field.

That is hardly an unusual configuration.

Recruitment forms frequently allow applicants to upload résumés. Support forms accept screenshots or documents. Ecommerce sites may allow customers to attach receipts, while membership systems may request identification or photographs.

Patchstack notes that the vulnerable configuration is common and does not require administrators to enable an unusual or insecure option. The File Upload field’s “Required” setting is disabled by default, which is sufficient for the vulnerable processing path.

The lack of an authentication requirement significantly increases the risk. Attackers do not need to steal credentials, register an account or compromise another WordPress user first.

They can potentially attack the vulnerable form directly from the internet.

The uploaded PHP file is stored under Elementor’s form-upload directory using a generated filename. Once the attacker determines the resulting location and executes the script, the consequences depend largely on the permissions available to PHP and the underlying web server.

In a typical WordPress environment, arbitrary PHP execution could potentially allow an attacker to modify site files, access the WordPress database, steal configuration secrets, create administrator accounts or install persistent backdoors.

The compromised website could subsequently be repurposed for phishing, malicious redirects, spam distribution or malware delivery.

That makes unrestricted file upload vulnerabilities particularly dangerous in PHP applications. The attacker is not merely placing unauthorized content on the server; they are potentially introducing executable server-side code into the application environment.

The disclosure arrives as researchers are also tracking a large-scale operation called StopAndProtect, in which thousands of compromised WordPress websites are being transformed into infrastructure supporting other cybercrime operations.

Those websites are reportedly being used for malware distribution, command-and-control communications and storage of stolen information.

This illustrates why WordPress vulnerabilities matter beyond the individual website owner.

A compromised site can become part of a much larger malicious ecosystem. Because legitimate websites already possess established domains, hosting infrastructure and reputation, attackers can use them to make malicious traffic appear less suspicious.

For criminals, compromising thousands of relatively ordinary websites can provide a disposable infrastructure layer without requiring them to purchase or directly operate every server themselves.

Elementor addressed CVE-2026-32475 in Elementor Pro 4.2.2, making upgrading the clearest remediation for affected websites.

Administrators should not limit their response to installing the patch if the vulnerable configuration was publicly accessible before the update.

Because exploitation can result in arbitrary PHP execution, previously exposed websites should also be examined for unexpected PHP files, unfamiliar WordPress administrator accounts, unauthorized plugins, modified themes, suspicious redirects and other indications of compromise.

Security teams should pay particular attention to the Elementor forms upload directory and other writable locations where attackers might have placed additional persistence mechanisms.

If compromise is suspected, credentials associated with WordPress, hosting control panels, databases and other services accessible from the server may also need to be rotated.

CVE-2026-32475 demonstrates why file-upload functionality requires multiple independent security controls.

Checking a filename extension alone is rarely sufficient. Applications can validate MIME types, inspect file contents, generate unpredictable filenames, prevent uploaded directories from executing scripts and store files outside the public web root.

These controls provide defense in depth.

If one validation mechanism fails, an uploaded PHP file should ideally still be unable to execute.

The Elementor Pro vulnerability became critical because a discrepancy in file-processing logic allowed an attacker to cross several important security boundaries at once: an anonymous internet user could bypass extension validation, place a PHP file inside a public directory and potentially execute that file on the server.

For WordPress administrators running Elementor Pro, the priority is therefore straightforward:upgrade to version 4.2.2 or later and investigate previously exposed installations for evidence that malicious files were uploaded before the patch was applied.

⁠Original report at The Hacker News