Critical File Upload Vulnerability in Elementor Pro WordPress Plugin Exposes Millions of Sites to Unauthenticated RCE
Executive Summary
A critical arbitrary file upload vulnerability has been disclosed in Elementor Pro (The Hacker News, Wordfence), the premier commercial website builder plugin powering millions of WordPress websites worldwide. The flaw allows unauthenticated remote attackers to bypass file extension validation routines and upload executable PHP web shells directly into public WordPress upload directories, leading to immediate unauthenticated Remote Code Execution (RCE) and full web server takeover.
Deep-Dive Technical Analysis
Vulnerability Mechanism & AJAX Handler Flaw
The vulnerability exists in Elementor Pro's native Form Widget component when configured to accept user file attachments. When a published page contains an Elementor Pro form with a File Upload widget:
1. Client-Side Validation Bypass: The plugin relies on client-side and weak server-side checks in its AJAX submission handler to verify permitted file extensions.
2. MIME-Type & Extension Discrepancy: An unauthenticated attacker sends a crafted multi-part HTTP POST request directly to the admin-ajax.php endpoint, manipulating parameter headers to deliver a PHP executable payload (e.g., shell.php) disguised as an allowed media type.
3. Unrestricted Webroot Placement: The server saves the file into the public /wp-content/uploads/elementor/forms/ directory without renaming the extension or stripping executable permissions.
4. Arbitrary Code Execution: The attacker requests the uploaded file's URL via HTTP GET, triggering direct PHP execution under the web server's user context (e.g., www-data).
Post-Exploitation & Threat Actor Tradecraft
Once code execution is established, attackers automate the following attack chain:
* Credential Harvesting: Extract database connection credentials from wp-config.php to dump WordPress user credentials and password hashes.
* Persistent Backdoors: Inject administrative accounts into wp_users, modify active theme functions.php files, and establish scheduled tasks via WordPress cron (wp_schedule_event).
* SEO Spam & Malware Delivery: Trojanize ecommerce checkout forms to capture payment cards and inject malicious redirects.
Industry Impact & Threat Landscape
Elementor Pro is one of the most widely deployed commercial WordPress plugins, utilized by enterprise brands, media outlets, and digital commerce sites. Unauthenticated arbitrary file upload flaws in widely deployed page builders represent the most actively weaponized category of CMS vulnerabilities, frequently integrated into automated mass-exploitation botnets within hours of public disclosure.
Actionable Recommendations & Mitigations
1. Immediate Plugin Upgrade: Upgrade Elementor Pro to the latest patched version immediately.
2. Disable PHP Execution in Upload Directories: Configure the web server to prohibit the execution of PHP scripts in the WordPress uploads path:
* Nginx:
location ~* /wp-content/uploads/.*\.php$ {
deny all;
}
* Apache (via .htaccess in /wp-content/uploads/):
deny from all
3. Deploy Web Application Firewall (WAF) Rules: Enforce WAF inspection rules to detect and block multi-part requests carrying executable extensions (.php, .phtml, .phar) targeted at WordPress AJAX endpoints.
4. Filesystem Auditing: Inspect the /wp-content/uploads/elementor/ directory for unfamiliar PHP scripts and audit the WordPress administrator user roster.
________________
Sources & References: The Hacker News, Wordfence Threat Intelligence.