Critical Elementor Pro Flaw Allows Unauthenticated PHP Upload and RCE

Cybersecurity researchers have disclosed a critical vulnerability in the Elementor Pro WordPress plugin that could allow unauthenticated attackers to upload PHP files and achieve remote code execution. Tracked as CVE-2026-32475 with a CVSS score of 9.0, the flaw resides in the Forms module’s File Upload field. Patchstack, the WordPress security company that disclosed the issue, explained that the extension check and file-move step run in separate loops with different handling of empty file entries. By submitting two file parts for the same field, an attacker can bypass the extension blocklist and write a PHP file into a public directory, turning a restricted file-upload field into an unauthenticated RCE primitive.

The vulnerability affects all versions of Elementor Pro prior to and including version 4.2.1. The only precondition is that the target site has at least one published Elementor page with a Form widget containing a File Upload field. This is a common configuration, as job application forms, photo uploads, and support ticket attachments often use it. The ‘Required’ toggle being off is the default state, so no special settings are needed.

Security researcher Tin Pham (TF1T) discovered and reported the flaw via the Patchstack Bug Bounty Program. Elementor Pro released a patched version 4.2.2 on August 19, 2026, after the issue was reported on July 16. The disclosure coincides with a WordPress core update (7.0.4) addressing a high-severity RCE vulnerability (CVE-2026-65640) involving malicious Postscript file uploads by Author-level users, and with the discovery of a large-scale operation called StopAndProtect that compromises WordPress sites for malware delivery and C2.

WordPress users are advised to update their plugins and core, scan for unauthorized modifications, and audit for unknown accounts and plugins.