Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks

A critical unauthenticated remote code execution (RCE) vulnerability in Elementor Pro — one of WordPress's most popular premium page builder plugins — was disclosed on August 19, 2026. Tracked as CVE-2026-32475 with a CVSS score of 9.0 (Critical), the flaw allows any unauthenticated attacker to upload a PHP webshell to a vulnerable site and execute arbitrary code.

The Vulnerability

The bug lives in Elementor Pro's Forms module, specifically in the File Upload field handler (modules/forms/fields/upload.php). It arises from a desynchronization between two separate code loops that handle the same multipart upload request differently:

• Validation loop (validation() method): When it encounters an empty file entry (HTTP error UPLOAD_ERR_NO_FILE), it calls return — exiting the entire loop and skipping extension checking for all remaining file parts.
• Processing loop (process_field() method): When it encounters an empty file entry, it uses continue — skipping only that entry and then processing subsequent file parts normally, including moving them to disk.

The result: an attacker can submit a multipart upload where the first part is empty and the second part is a PHP file. The validator sees the empty entry and quits; the processor skips the empty entry and writes the PHP file to disk, bypassing the extension blocklist entirely.

Exploitation Details

The attack requires no authentication and no privileged account. An attacker needs only:

• A publicly accessible page with an Elementor Form widget containing a File Upload field
• A crafted multipart HTTP POST request

Uploaded files land in wp-content/uploads/elementor/forms/ with filenames generated by PHP's uniqid() — a time-based function. Attackers can recover the exact filename through:

• Timing brute-force: uniqid() output is derived from server microtime, allowing narrow enumeration
• Email disclosure: If form autoresponse email is enabled, the filename may appear in the response

Once the filename is known, a single GET request executes the uploaded shell with web server privileges — full RCE.

Elementor Pro's extension blocklist explicitly prohibits php, php3–php7, phtml, shtml, pht, and more. The loop desync bypasses all of it.

Affected Versions

Elementor Pro has over 12 million active installations, making this a high-priority patch.

Patch

Elementor released version 4.2.2 on August 19, 2026. The fix:

• Aligns both loops to handle empty entries consistently (using continue in both)
• Adds a secondary extension validation immediately before the file-move operation as a defense-in-depth check

Patchstack also released a virtual patch for sites that cannot update immediately.

Timeline

No confirmed in-the-wild exploitation had been observed at time of publication, but given the unauthenticated attack vector and high CVSS score, opportunistic scanning was considered imminent.

Recommendations

1. Update Elementor Pro to 4.2.2 immediately. This is the only complete fix.
2. If you cannot update, disable or remove all forms containing File Upload fields until patched.
3. Check wp-content/uploads/elementor/forms/ for unexpected .php files — any found should be treated as a potential compromise indicator.
4. Implement Patchstack's virtual patch as a short-term stopgap.
5. Review web server logs for unusual POST requests to form submission endpoints.

References

• BleepingComputer — Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks
• Patchstack — Critical Unauthenticated File Upload to RCE in Elementor Pro
• The Hacker News — Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
• CVE-2026-32475 — cve.org