Critical Elementor Pro CVE Enables Unauthenticated RCE on WordPress Sites

A critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload executable PHP files for remote code execution on affected servers. Furthermore, the flaw has been actively disclosed and patched, yet administrators must verify their sites remain uncompromised.

What Happened: Critical Elementor Pro File Upload Flaw Enables RCE on WordPress Sites

On August 20, 2026, Elementor released version 4.2.2 of Elementor Pro to fix CVE-2026-32475, a critical file-upload vulnerability in the plugin’s Form File Upload module. The flaw allows remote attackers to bypass file validation checks and upload malicious PHP payloads to publicly accessible directories.

Patchstack researchers discovered the vulnerability and coordinated disclosure with Elementor. Tin Pham initially reported the flaw to Patchstack on July 16, 2026. The Elementor team prepared a fix by July 17, and Patchstack verified the patch on August 3 before public disclosure.

Technical Details of the Elementor Pro RCE Vulnerability

CVE-2026-32475 stems from a logic mismatch between two separate loops that handle multipart file uploads in Elementor Pro’s File Upload module. One loop validates uploaded files, while another processes them for storage. Consequently, a carefully crafted multipart upload can pass validation for one entry but execute processing on another.

An attacker crafts a multipart upload where the first entry has an empty filename. The validation loop encounters this empty entry, dismisses it with a UPLOAD_ERR_NO_FILE error, and exits without examining subsequent parts. However, the processing loop skips the empty entry and moves the remaining parts into a public uploads directory.

The uploaded PHP payload lands in wp-content/uploads/elementor/forms/, a web-accessible location. When the attacker requests the file URL, the server’s PHP interpreter executes the payload with web server privileges.

Moreover, the filename is generated using PHP’s uniqid() function, which relies on the current timestamp rather than cryptographically secure randomness. Therefore, attackers can brute-force the filename through timing-based enumeration. In some server configurations, they can also determine the exact URL through autoresponder emails generated by Elementor forms.

Exploitation Requirements

• A published Elementor form containing a File Upload field
• Multiple file upload option enabled (disabled by default)
• Network access to the target WordPress site

Scope of Impact

Elementor is one of the most popular WordPress page builders, with over 10 million active installations. Elementor Pro adds advanced features including form creation, theme builders, popup builders, custom code, and e-commerce tools. Therefore, the vulnerability primarily affects higher-tier WordPress sites that rely on Elementor Pro forms with file upload capabilities.

Business and Operational Impact

A successful exploitation of CVE-2026-32475 grants an attacker complete control over the affected WordPress site. Consequently, the consequences extend far beyond the immediate web server.

• Complete site compromise: Attackers can execute arbitrary PHP code with web server privileges
• Data exfiltration: Sensitive customer data, credentials, and database contents become accessible
• Malware distribution: Compromised sites can be repurposed to serve malware or phishing pages
• SEO poisoning: Attackers can inject spam content that damages search rankings
• Lateral movement: Shared hosting environments face elevated risk of cross-site contamination
• Regulatory exposure: Data breaches triggered by this flaw may trigger GDPR, CCPA, or industry-specific reporting obligations

At the time of publication, Patchstack has not observed active exploitation in the wild. However, the publication of detailed technical information and proof-of-concept conditions makes exploitation by threat actors increasingly likely.

Mitigation and Recommendations

Elementor has released Elementor Pro version 4.2.2, which resolves the vulnerability. Therefore, administrators should update immediately and perform post-incident verification.

Immediate Actions for Defenders

1. Update Elementor Pro to version 4.2.2 or later as soon as possible
2. Inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other suspicious uploads
3. Review web server access logs for POST requests to Elementor form endpoints followed by GET requests to uploaded files
4. Scan the WordPress installation with a security plugin for indicators of compromise
5. Verify that file upload fields are disabled on forms where they are not strictly required

Detection Guidance

Security teams should monitor for suspicious file uploads in the Elementor forms uploads directory. Moreover, web application firewalls can be tuned to block multipart uploads with empty filename entries followed by executable content. Log correlation between form submissions and subsequent file access attempts may reveal exploitation attempts.

Compromise Assessment

Patchstack emphasizes that updating the plugin does not remove malicious files uploaded during the exposure window. Consequently, administrators must manually audit the uploads directory. Check file timestamps against known maintenance windows, and look for files with extensions such as .php, .php5, .phtml, or .phar in the forms uploads path.

Bottom line: Update Elementor Pro immediately, audit your uploads directory for rogue files, and disable file uploads on forms that do not require them. A patched plugin does not clean up a previously compromised site.

Incident Summary

CVE ID / Incident:	CVE-2026-32475
Affected Systems:	Elementor Pro versions before 4.2.2 on WordPress
Severity:	Critical — Unauthenticated Remote Code Execution
Disclosure Date:	August 20, 2026 (Patchstack public disclosure)
Patch Status:	Fixed in Elementor Pro 4.2.2 — update immediately
Exploitation Status:	No confirmed in-the-wild exploitation observed at time of writing

References

1. Bill Toulas, “Critical Elementor Pro bug exposes WordPress sites to RCE attacks,” BleepingComputer, August 20, 2026, https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/, accessed August 23, 2026.
2. Patchstack, “Critical unauthenticated file upload to RCE in Elementor Pro plugin,” Patchstack Blog, August 20, 2026, https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/, accessed August 23, 2026.
3. National Vulnerability Database, “CVE-2026-32475 Detail,” NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-32475, accessed August 23, 2026.
4. Elementor, “Elementor Pro Security Update — August 2026,” Elementor Security Advisory, August 20, 2026, accessed August 23, 2026.