A Critical Vulnerability in Elementor Pro Exposes WordPress Sites to Remote Code Execution Attacks
A serious security bug has been discovered in the popular Elementor Pro plugin, which could allow attackers to upload malicious files and execute arbitrary code on vulnerable websites. The flaw, identified as CVE-2026-32475, affects all versions of Elementor Pro prior to 4.2.2 and poses a significant risk to sites that use the plugin’s File Upload module.
The vulnerability stems from a discrepancy in how the plugin handles empty file uploads. According to a report by Patchstack, a cybersecurity company focused on the WordPress ecosystem, the validation loop and processing loop have different early-exit logic for empty entries, allowing an attacker to craft a multipart upload that is validated as safe but executed maliciously.
This means that an attacker could exploit this behavior by crafting a carefully shaped multi-part upload in which the first entry has an empty filename, followed by a malicious PHP payload. The validation routine would exit after examining the first part, dismissing it with an error and never checking the second part. Meanwhile, the processing step would skip the empty entry but move the malicious PHP to a public directory on the server, where it could be executed.
Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has over 10 million active installs. The Pro version adds advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, making it a favorite among higher-grade platforms.
To exploit this vulnerability, an attacker only needs to have a published Elementor form containing a File Upload field on the target site. They can then determine the filename of the malicious payload in the public directory through a timing brute-force attack or by obtaining its exact URL through an autoresponder email. Once the file is requested at that URL, the server’s PHP interpreter would execute its contents, allowing arbitrary code to run with the privileges of the web server.
Fortunately, Elementor has quickly addressed this issue and released a fix on August 3, which was verified by Patchstack. The plugin developer has also notified its subscribers of the vulnerability, noting that only sites that use an Elementor Pro Form with an upload file form field and the multiple file upload option enabled are at risk.
To protect your site from this vulnerability, administrators should update to the latest version of Elementor Pro as soon as possible and check the ‘wp-content/uploads/elementor/forms/’ directory for any malicious files or other rogue files. Patchstack also recommends a thorough examination of uploaded files during the exposure period, even after updating to the latest version.
While no cases of active exploitation have been observed in the wild so far, this vulnerability serves as a reminder of the importance of regular updates and vigilant monitoring of plugin vulnerabilities.
Source: Bleeping Computer — 2026-08-20