CVE-2026-32475: Elementor Pro Unauthenticated RCE Flaw

Critical Elementor Pro RCE Flaw (CVE-2026-32475) Disclosed

Cybersecurity researchers have unveiled details regarding a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-32475, impacting the Elementor Pro WordPress plugin. This flaw, assigned a CVSS score of 9.0, enables unauthenticated attackers to upload arbitrary PHP files, leading to full system compromise. The discovery by Tin Pham (TF1T) and subsequent disclosure by Patchstack highlight a significant risk to the vast number of WordPress sites utilizing this popular page builder. The issue was patched in Elementor Pro version 4.2.2, released on August 19, 2026.

This disclosure arrives alongside another high-severity RCE vulnerability in WordPress core, CVE-2026-65640 (CVSS 8.8), and a broader campaign named “StopAndProtect” leveraging compromised WordPress sites for malicious activities. Website administrators must prioritize urgent patching and security reviews to mitigate these escalating threats, as reported by The Hacker News.

Technical Analysis of Elementor Pro’s Unrestricted File Upload Vulnerability

The core of CVE-2026-32475 resides within the Forms module’s File Upload field in Elementor Pro. According to Patchstack, the vulnerability stems from a logical flaw where the file extension check and the file-move operation occur in two separate loops. These loops handle empty file entries differently, creating a critical bypass opportunity. An unauthenticated attacker can submit two file parts for the same field, effectively bypassing the plugin’s extension blocklist. This allows them to write a PHP file into a public directory on the server.

The path for these malicious uploads is wp-content/uploads/elementor/forms/<uniqid>.php, where <uniqid> is generated by PHP’s uniqid() function. The only precondition for exploitation is that the target WordPress site must have at least one published Elementor page containing a Form widget with a File Upload field. This configuration is described as “extremely common” and “everyday,” frequently found in job application forms, support ticket attachments, or forms requiring document uploads. Crucially, the ‘Required’ toggle for the file upload field defaults to off, meaning no unusual or hardened settings are needed for the flaw to be exploitable. This makes the Elementor Pro 4.2.1 unrestricted upload vulnerability a highly accessible vector for compromise.

Associated WordPress Core Vulnerability and Broader Threats

In addition to the Elementor Pro flaw, WordPress recently addressed CVE-2026-65640, a high-severity issue with a CVSS score of 8.8. This vulnerability affects WordPress core versions 4.7 through 7.0.3 and permits remote code execution via a malicious Postscript file upload. Exploitation requires an Author-level user or higher to be logged in. The update to WordPress 7.0.4 modifies how WordPress processes uploaded media with ImageMagick, closing a path that could allow a logged-in author to convert an ordinary-looking image upload into server-side code execution. While requiring authentication, this remains a significant threat for multi-author publications, membership sites, or client sites with contributors, where the risk of an Author uploading a booby-trapped ‘image’ is realistic.

Furthermore, the “StopAndProtect” operation illustrates an ongoing large-scale threat where compromised WordPress websites are being repurposed as distributed infrastructure for malware delivery, command-and-control communications, and data exfiltration. This broader context underscores the urgency for comprehensive WordPress security hygiene.

Actionable Recommendations and Mitigations

Defenders must prioritize immediate actions to protect their WordPress installations against these vulnerabilities and broader threats.

• Patch Elementor Pro Immediately: The most critical step is to update Elementor Pro to version 4.2.2 or higher without delay. This patch directly addresses CVE-2026-32475. Site owners using Elementor Pro should verify their version and apply the update.
• Update WordPress Core: Ensure WordPress core is updated to version 7.0.4 to mitigate CVE-2026-65640. This is particularly crucial for sites with multiple authors or open registration.
• Review File Upload Configurations:
  • Audit all Form widgets in Elementor Pro to assess if they use File Upload fields.
  • Consider restricting file types allowed in upload fields to only necessary, non-executable formats (e.g., specific image types, PDFs, if the plugin allows).
  • Implement additional server-side validation for uploaded files, if possible, to prevent execution of malicious scripts.
• Implement Enhanced Monitoring:
  • Monitor wp-content/uploads/elementor/forms/ directory for suspicious PHP files.
  • Scan for unauthorized modifications, unexpected redirects, or pop-ups, which can indicate compromise by campaigns like StopAndProtect.
  • Regularly audit user accounts and installed plugins for unknowns or suspicious activity.
• Strengthen Overall WordPress Security:
  • Use strong, unique passwords and multi-factor authentication (MFA).
  • Limit user privileges to the minimum necessary.
  • Regularly back up your website.
  • Employ a Web Application Firewall (WAF) to help filter malicious requests.

Understanding WordPress CVE-2026-65640 mitigation and the critical nature of the Elementor Pro vulnerability is essential for maintaining site integrity. Proactive patching and continuous security vigilance are paramount in defending against these actively exploited and widespread threats.

Related: BdThemes WordPress Plugin Supply Chain Attack Creates Rogue Admins, CVE-2026-8037: Progress LoadMaster Command Injection RCE