Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks

A critical security flaw in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload malicious PHP files and execute code on vulnerable servers.

Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro versions up to and including 4.2.1 and is fixed in version 4.2.2.

Elementor Pro is a premium extension for the Elementor page builder. Its Forms widget lets website owners create contact, job application, support, and document-submission forms. The vulnerable feature is the File Upload field that allows visitors to attach files.

The flaw exists because the plugin handles file validation and file storage in separate loops. Under normal conditions, Elementor Pro checks uploaded file extensions against an allowlist and a blocklist. Dangerous extensions such as .php, .phtml, .asp, and .exe should be rejected.

WordPress Plugin Vulnerability

However, the two loops treat empty upload entries differently. An attacker can submit multiple file parts for a single upload field, placing an empty file entry first and a malicious PHP file afterward.

The validation routine stops when it encounters the empty entry, meaning it never checks the PHP file. The file-processing routine skips the empty entry and continues saving the subsequent malicious file.

As a result, an attacker may be able to place a PHP payload inside the public Elementor forms upload directory. If the uploaded file is accessed via a browser, the web server could execute it, granting the attacker remote code execution with the web server’s permissions.

The attack does not require a WordPress account, credentials, or administrator interaction. The primary requirement is a publicly available Elementor Pro Form widget that includes a File Upload field.

Elementor stated that the multiple file upload option must also be enabled, and that option is disabled by default. Affected administrators should immediately update Elementor Pro to version 4.2.2 or later.

The updated release aligns file validation and processing behavior and adds stronger validation closer to the file-moving process. Updating alone is not enough for sites that may be exposed.

The issue was discovered by security researcher Tin Pham, also known as TF1T, and reported through Patchstack. Patchstack published mitigation rules for its customers while Elementor prepared and released the security update on August 19, 2026.

Administrators should inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other executable content. Any suspicious files should be treated as possible indicators of compromise and investigated before removal.

Website owners should also review public upload forms, turn off unnecessary file-upload functionality, restrict accepted file types, and prevent PHP execution in WordPress upload directories.

Although no active exploitation had been publicly observed at the time of reporting, the flaw’s unauthenticated nature makes rapid patching essential.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks appeared first on Cyber Security News.

>>More