Critical Vulnerability in Elementor Pro Threatens WordPress Sites
Photo: BleepingComputer
Quick answer
The critical CVE-2026-32475 vulnerability in Elementor Pro for WordPress allows attackers to execute arbitrary code on servers by uploading malicious files.
Security researchers at Patchstack have identified a critical vulnerability in the Elementor Pro plugin for WordPress, enabling remote code execution on servers. Tracked as CVE-2026-32475, the flaw stems from improper handling of empty filenames in the plugin's upload module. Due to discrepancies in file validation logic, attackers can bypass security checks and upload malicious PHP code to the site's public directory.
Exploiting this vulnerability requires a site with an Elementor form that includes a file upload field, with multiple file uploads enabled (disabled by default). After uploading a malicious file, attackers can determine its name via brute-force or automated email responses, allowing arbitrary code execution on the server with web server privileges.
Elementor developers have released a patch in version 4.2.2, verified and approved by Patchstack experts. The company noted that the update does not remove already uploaded malicious files, so administrators should scan the wp-content/uploads/elementor/forms/ directory for suspicious files. As of now, no active exploitation of the vulnerability has been reported.
Common questions
- Which versions of Elementor Pro are vulnerable to CVE-2026-32475?
- The vulnerability affects all versions of Elementor Pro prior to 4.2.2. Users are advised to update immediately.
- How can attackers exploit this vulnerability?
- Exploitation requires a site with an Elementor form featuring a file upload field. Attackers can upload a malicious PHP file, which will then be executed on the server.
- How can I protect my site from this vulnerability?
- Update the plugin to version 4.2.2 or later, and scan the wp-content/uploads/elementor/forms/ directory for suspicious files.
Dzen feed: /feed/dzen.xml · RSS: /feed.xml