A critical remote code execution (RCE) vulnerability, identified as CVE-2026-32475, has been discovered in the Elementor Pro WordPress plugin, potentially allowing attackers to upload executable files to affected websites. The flaw impacts Elementor Pro versions prior to 4.2.2.
The vulnerability resides within the File Upload module of Elementor Pro, specifically in how it handles multipart file uploads with empty filenames. According to analysis, the validation and processing loops within the module exhibit differing early-exit logic when encountering an upload part with a blank filename (which PHP reports as UPLOAD_ERR_NO_FILE). This discrepancy allows an attacker to bypass validation.
An attacker can exploit this by crafting a multipart upload where the first entry has an empty filename, followed by a malicious PHP payload in a subsequent part. The validation routine processes the first part, encounters the empty filename, and exits without checking the subsequent parts. However, the processing step skips the empty entry but continues to move the malicious PHP file to a publicly accessible directory, `wp-content/uploads/elementor/forms/`.
Elementor Pro is the paid version of the widely used Elementor drag-and-drop website builder for WordPress, which boasts over 10 million active installations. The Pro version offers advanced features, including form creation, which is central to this vulnerability.
Exploitation of CVE-2026-32475 requires the target website to have a published Elementor form that includes a File Upload field. After successfully uploading the malicious PHP file, an attacker can determine its filename, which is generated using the time-based `uniqid()` function, through timing-based brute-force attacks. In some configurations, the exact URL of the uploaded file might be disclosed via an autoresponder email. Once the attacker requests this URL, the server's PHP interpreter executes the file's contents, granting arbitrary code execution with the web server's privileges.
The vulnerability was discovered by researcher Tin Pham on July 16 and reported to Elementor. The plugin developer prepared a fix the following day, which was verified on August 3 and subsequently released.
Elementor has confirmed the vulnerability and notified its subscribers, clarifying that only "websites that use an Elementor Pro Form with an upload file form field, and the multiple file upload option enabled (it is disabled by default)" are at risk. The vendor advises all users to update to the latest Elementor Pro version to mitigate potential security and incompatibility issues, even if their site configurations do not meet the specific exploitation criteria.
Administrators are strongly advised to update to Elementor Pro 4.2.2 or later. Additionally, they should manually inspect the `wp-content/uploads/elementor/forms/` directory for any suspicious PHP files or other unauthorized files, as updating the plugin will not remove malicious files uploaded during the period of exposure. As of the latest reports, no active exploitation of this vulnerability has been observed in the wild.
