www.it-connect.fr
Critical Elementor Pro Flaw Lets Attackers Take Over WordPress Sites
New alert for all WordPress site administrators: the CVE-2026-32475 flaw, patched on August 19, 2026 in Elementor Pro, allows an anonymous visitor to upload a PHP file to a WordPress site and then execute it. No account, no interaction with an administrator. The site only needs to publish an Elementor form with a file upload field. Here is what we know about this potential threat.
For the record: Elementor Pro is the paid version of Elementor, one of the most widely used page builders in the WordPress ecosystem. The free version has more than 10 million active installations according to WordPress.org. For the Pro edition, there would be at least 6 million installations. It is one of the most widely used plugins on WordPress sites.
Two loops, two rules, and a check that never runs
The security flaw is located in the Forms module, more precisely in the "File Upload" field type, which allows a visitor to attach a document to a form. The security issue comes from a processing error when a file is submitted through this path.
First, the code validates extensions using a blacklist that blocks files php, phtml or exe. Then it moves the files to the public directory wp-content/uploads/elementor/forms/. The problem appears when there are empty entries: validation stops as soon as it encounters one, while processing simply ignores it and continues.
For an attacker, it is enough to send two parts for the same field: a first empty one, and a second containing the PHP payload. There is, in a way, a desynchronization in the processing logic between the validation mechanism and the file-move mechanism. As a result, the malicious file uploaded by a potential attacker ends up stored on the server.
"An attacker exploits this flaw by submitting the upload field as an array containing two parts. The first part is empty, which triggers the UPLOAD_ERR_NO_FILE error and causes an early return, completely bypassing validation. The second part contains a PHP payload with a file extension chosen by the attacker, which is never checked.", Wordfence explains in its report.
The remaining step is finding it, since its name is regenerated on the server side. According to Patchstack, that would not really be difficult: the function used relies on the clock rather than on randomness. In some cases, an email notification is sent to the person who fills out the form, and the file link is included there.
Two researchers, two scores, one same flaw
The vulnerability was reported twice, independently. That is what the bulletins published by Patchstack and Wordfence suggest.
Tin Pham (TF1T) reported it to Patchstack on July 16, 2026, which alerted the vendor the same day. At that point, the flaw was assigned the CVE-2026-32475 identifier. Then another researcher reported it to Wordfence on July 24. There was no new CVE identifier since it is the same flaw.
In any case, Patchstack and Wordfence agree on one point: all it takes is a page with a form containing at least one non-mandatory upload field.
At the time the advisories were published, no real-world exploitation had been observed. Still, experience suggests not to delay: we had already covered an arbitrary file upload flaw in Slider Revolution in spring 2026, and Elementor Pro had been actively exploited in 2023.
How can you protect yourself from CVE-2026-32475?
This security flaw affects WordPress sites where the Elementor Pro plugin is installed. It is essential to update the plugin to version 4.2.2 (or later) in order to benefit from the patch.
As an added precaution, it may be wise to inspect the wp-content/uploads/elementor/forms/ directory for .php files or other suspicious files. In other words, look for any file that your forms would not normally accept. This is important because the patch does not remove any malicious files that may already have been uploaded... Even though, for now, there is no indication that this flaw is being exploited.
After the series of flaws in the WordPress Core triggered by the discovery of the wp2shell vulnerability, one of the flagship plugins is now receiving a patch for a critical flaw. Clearly, there is no shortage of WordPress news this summer.
