WordPress Ecosystem Flaw: Critical Unauthenticated File Upload in Elementor Pro Endangers 6 Million Websites (CVE-2026-32475)
Executive Summary
A critical unauthenticated remote code execution (RCE) vulnerability was disclosed on August 22–23, 2026, affecting Elementor Pro, the premium WordPress website builder plugin deployed on over 6 million active websites. Tracked as CVE-2026-32475 (CVSS 9.0/9.8), the flaw resides in the plugin's built-in Forms module. By exploiting an architectural logic discrepancy between file-extension validation loops and file-storage operations, unauthenticated remote attackers can bypass file-type blocklists to upload arbitrary PHP scripts directly into publicly reachable directories, achieving full web server takeover. Elementor released patched version 4.2.2 following responsible disclosure via Patchstack.
Deep-Dive Technical Analysis of CVE-2026-32475
The vulnerability stems from inconsistent multi-part file handling in Elementor Pro's Form submission parser:
1. Inconsistent Validation vs. File-Move Loop Traversal
The flaw abuses how the Forms module parses nested multi-part upload arrays:
* The Dual Loop Discrepancy: When processing a form submission containing a File Upload field, Elementor Pro executes two consecutive loops. The first loop verifies file extensions against a disallowed extension blocklist (e.g., .php, .phtml, .exe), while the second loop moves uploaded temporary files to the target directory (wp-content/uploads/elementor/forms/).
* Multi-Part Array Desynchronization: The two loops handle empty multi-part file entries differently. By submitting a multi-part payload containing two file parts for a single File Upload field—where the first part is empty and benign and the second part contains a malicious PHP payload—the validation loop inspects the benign entry while the storage loop processes and saves the PHP script.
* Public Web Shell Execution: The uploaded PHP file is written to wp-content/uploads/elementor/forms/
2. Attack Preconditions & Fleet-Wide Impact
The attack surface is exceptionally broad across WordPress environments:
* Zero Authentication Required: The exploit requires no user authentication, subscriber accounts, or CSRF nonces.
* Precondition: The target WordPress site only needs to have a published page containing an Elementor Pro form with an active File Upload field.
* Potential for Automated Exploitation: Because automated scanning engines can rapidly crawl site forms and submit crafted multi-part POST payloads, mass automated exploitation targeting unpatched WordPress fleets is imminent.
Attribute
Details
Target Software
Elementor Pro (WordPress Plugin)
Vulnerability Identifier
CVE-2026-32475
Vulnerability Class
Unrestricted Upload of File with Dangerous Type (CWE-434)
CVSS v3.1 Score
9.0 / 9.8 (Critical)
Affected Versions
Elementor Pro ≤ 4.2.1
Patched Version
Elementor Pro 4.2.2 (Released August 19, 2026)
Discovery Credit
Tin Pham (TF1T) via the Patchstack Bug Bounty Program
The Fragility of Content Management System (CMS) Form Handlers
Form upload widgets represent one of the most dangerous components in web application architectures. When custom plugin frameworks implement their own file-handling routines rather than relying on native core platform sanitizers, subtle logic flaws in array parsing can completely neutralize extension blocklists.
Website administrators who rely on "set-and-forget" agency builds face immediate risk of silent backdoor implantation and search engine optimization (SEO) spam injection.
Recommendations and Mitigations
WordPress administrators, web agencies, and security teams must execute the following defensive actions immediately:
1. Upgrade Elementor Pro to Version 4.2.2 or Later: Apply the official Elementor Pro 4.2.2 security update across all managed WordPress sites immediately.
2. Deploy Web Application Firewall (WAF) Virtual Patching: Implement Patchstack, Wordfence, or Cloudflare WAF rules to intercept multi-part HTTP POST requests targeting Elementor form endpoints with mismatched array indices.
3. Disable PHP Execution in WordPress Upload Directories: Configure NGINX or Apache .htaccess rules to block direct PHP execution inside wp-content/uploads/:
Order Deny,Allow
Deny from all
4. Audit Uploads Folder for Unauthorized PHP Files: Run forensic scans across wp-content/uploads/elementor/forms/ to identify and remove rogue .php or .phtml scripts created prior to patching.