A critical security vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload malicious executable files and remotely run code on vulnerable websites.
Tracked as CVE-2026-32475, the flaw affects Elementor Pro versions earlier than 4.2.2 and is related to the plugin’s File Upload module.
The vulnerability comes from the way Elementor Pro validates and processes uploaded files. According to cybersecurity company Patchstack, the two routines handle empty filename entries differently, allowing a malicious file to bypass validation yet still be processed and moved to a publicly accessible directory.
The problem involves a multipart upload containing an empty filename followed by a malicious PHP file. During validation, the first empty entry can cause the validation process to stop after receiving the UPLOAD_ERR_NO_FILE error. The second malicious file is therefore not properly checked. However, the processing routine skips the empty entry and continues handling the remaining upload, potentially placing the PHP file inside wp-content/uploads/elementor/forms/.
Elementor is one of the most widely used WordPress website builders, with more than 10 million active installations. Elementor Pro is its paid version and adds features such as forms, theme and popup builders, custom code and CSS, and e-commerce functionality.
Exploitation of CVE-2026-32475 requires a website to have a published Elementor form containing a File Upload field. The multiple-file upload option must also be enabled, although Elementor says this option is disabled by default.
Once a malicious PHP file has been uploaded, an attacker needs to determine its filename before requesting it. Patchstack says Elementor generates the filename using PHP’s uniqid() function, which is time-based rather than truly random. This can potentially allow attackers to discover the filename through timing-based brute-force techniques. In some configurations, an autoresponder email could also reveal the exact URL of the uploaded file.
If the attacker successfully accesses the uploaded PHP file, the server’s PHP interpreter can execute the malicious code with the privileges available to the web server. This could give the attacker the ability to perform arbitrary actions on the compromised WordPress installation.
Patchstack said it learned about the vulnerability from security researcher Tin Pham on July 16. Elementor prepared a fix the following day, and Patchstack verified the fix on August 3. The patched release was subsequently made available.
Elementor has warned that the vulnerability specifically affects websites using an Elementor Pro form with a File Upload field and the multiple-file upload option enabled. The company says other Elementor websites are not affected, but still recommends updating to the latest version.
Website administrators should update Elementor Pro to the latest available release and inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other suspicious files. Updating the plugin alone will not remove files that may have been uploaded while a website was vulnerable, so administrators should also check for potential malicious files.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Patchstack said there are currently no known cases of CVE-2026-32475 being actively exploited in the wild.
Elementor Pro Vulnerability Could Let Hackers Take Over WordPress Sites
