A major security flaw (CVE-2026-32475) in the Elementor Pro plugin allows attackers to perform Remote Code Execution (RCE) via malicious file uploads. Website owners are urged to update immediately.

  • CVE-2026-32475 affects Elementor Pro versions prior to 4.2.2.
  • The flaw exploits a logic mismatch in the File Upload module.
  • Attackers can execute arbitrary code via uploaded PHP payloads.
  • Immediate updates and directory audits are highly recommended.

A critical vulnerability has been identified in Elementor Pro, the premium version of the widely used WordPress website builder. The flaw, identified as CVE-2026-32475, enables attackers to bypass file validation and perform Remote Code Execution (RCE), potentially granting full control over the target server.

The vulnerability stems from a discrepancy in how the plugin handles file uploads. According to cybersecurity firm Patchstack, the 'File Upload' module utilizes two separate loops: one for validation and another for processing. Due to a logic error, these loops disagree on how to handle empty filenames (reported as UPLOAD_ERR_NO_FILE by PHP). An attacker can craft a multipart upload where the first entry is empty, causing the validator to exit prematurely while the processor moves a subsequent malicious PHP payload into a public directory.

Read Also:Star Citizen Development Stream Collapses, Fueling Player Distrust

Why This Matters

BozokMedia analysis shows that Elementor Pro powers over 10 million active installations, many of which belong to high-traffic, enterprise-grade platforms. Because the payload is moved to wp-content/uploads/elementor/forms/, an attacker can execute code with the privileges of the web server, leading to complete site compromise, data theft, or server hijacking.

The ability to bypass validation through logic mismatches remains one of the most sophisticated and dangerous vectors in plugin-based ecosystems.

Researchers noted that while the uniqid() function makes filenames predictable via timing attacks, the primary risk lies in the ease of exploitation. To exploit this, a site only needs to have a published Elementor form with a File Upload field enabled with the 'multiple file upload' option.

Historical Background

Remote Code Execution (RCE) vulnerabilities in WordPress plugins have historically been among the most devastating security threats. As plugins become more feature-rich—handling everything from e-commerce to advanced CSS—the attack surface expands, making rigorous code audits and rapid patching essential for the stability of the global web ecosystem.

Did You Know?: The vulnerability specifically targets the 'multiple file upload' setting, which is disabled by default in most Elementor configurations.

Frequently Asked Questions

Q1: Is my website at risk?
A: If you use Elementor Pro with forms that allow multiple file uploads, you are at risk. Updating to the latest version is the first line of defense.

Q2: Will updating delete any existing malicious files?
A: No. Patchstack warns that updating the plugin does not remove files already uploaded by an attacker. You must manually inspect your upload directories.