A Critical Elementor Pro Bug Exposes WordPress Sites to Remote Code Execution Attacks
A severe vulnerability in the popular Elementor Pro plugin for WordPress has been uncovered, putting millions of websites at risk of remote code execution attacks. The flaw, identified as CVE-2026-32475, affects all versions of Elementor Pro prior to 4.2.2 and could allow attackers to upload malicious files that execute arbitrary code on the server.
The issue stems from a mismatch between two loops in the File Upload module, which handle file validation and processing differently when dealing with empty filename uploads. A skilled attacker can exploit this behavior by crafting a multipart upload containing an empty filename followed by a malicious PHP payload. This would cause the validation routine to exit prematurely, allowing the malicious code to be executed without being properly checked.
The Elementor Pro plugin is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress with over 10 million active installs. The Pro version adds advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, making it a favorite among higher-grade platforms.
To exploit this vulnerability, an attacker needs only to target a site that has published an Elementor form containing a File Upload field. Once the malicious PHP file is uploaded, the attacker can determine its filename in the public directory using a timing brute-force attack. In some cases, they may even be able to obtain the exact URL of the payload through an autoresponder email.
Once the attacker requests the uploaded file at that URL, the server’s PHP interpreter executes its contents, allowing arbitrary code to run with the privileges of the web server. This could potentially lead to data breaches, website defacement, or even full server compromise.
Fortunately, Elementor has already released a fix for this vulnerability, and administrators are urged to update their plugin to the latest version as soon as possible. It’s also essential to check the ‘wp-content/uploads/elementor/forms/’ directory for any rogue files or PHP scripts that may have been uploaded during the exposure period. Patchstack recommends conducting a thorough examination of these files to ensure no malicious code remains.
While there are currently no reported cases of active exploitation in the wild, this vulnerability serves as a stark reminder of the importance of keeping software up-to-date and monitoring for potential security risks. As always, it’s crucial to stay vigilant and take prompt action when vulnerabilities like this one arise to protect your website from potential attacks.
Source: Bleeping Computer — 2026-08-20