“The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” Patchstack wrote in its technical advisory.
CVE-2026-32475 — the flaw and how it becomes RCE
A critical vulnerability, tracked as CVE-2026-32475, exists in Elementor Pro versions before 4.2.2 and resides in the plugin’s File Upload module. The defect arises because the code uses two separate loops: one to validate uploaded parts and one to process them. Those loops handle an empty filename (reported by PHP as UPLOAD_ERR_NO_FILE) differently, creating a gap an attacker can exploit.
By crafting a multipart upload whose first part has an empty filename and whose second part contains a malicious PHP payload, an attacker can cause the validator to exit after dismissing the first empty part while the processing loop skips the empty part and continues to move the subsequent payload into a public directory — wp-content/uploads/elementor/forms/ — where it becomes accessible to a web request. When the uploaded file is requested, the server’s PHP interpreter executes it with the web server’s privileges, yielding remote code execution (RCE).
Technical details defenders need to know
- The exploit requires a published Elementor Pro form that includes a File Upload field with the multiple file upload option enabled (this option is disabled by default).
- Uploaded filenames are generated with PHP’s uniqid() function, which is time-based rather than random; Patchstack says an attacker can determine the uploaded filename via timing brute-force, and in some configurations can obtain the exact URL through an autoresponder email.
- Successfully reaching the payload URL causes the server to execute the PHP content, giving an attacker arbitrary code execution under the web server’s account.
- Patchstack reports no observed active exploitation in the wild at the time of publication.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTimeline: discovery to fix
Patchstack learned of CVE-2026-32475 on July 16 from researcher Tin Pham and shared the details with the Elementor team. The plugin developer prepared a fix the next day. Patchstack verified the remediation on August 3, and the vendor delivered the fix yesterday. Elementor has also notified its subscribers about the vulnerability, emphasizing the specific conditions that create risk.
Elementor Pro’s reach and which sites are affected
Elementor — the drag-and-drop website builder for WordPress — reports more than 10 million active installs. The Pro version, a paid add-on, provides form creation, theme and popup builders, custom code and CSS, and e-commerce tools. Patchstack and Elementor both stress that the vulnerability affects only sites using an Elementor Pro Form with a File Upload field and with multiple file uploads enabled; every other Elementor site is, according to the vendor, unaffected.
What this means for security teams, Elementor Pro administrators, and attackers
- Security teams: Verify that endpoints serving WordPress sites with Elementor Pro have been updated to 4.2.2 or later. Because updating the plugin does not remove files uploaded while the site was vulnerable, teams should inspect wp-content/uploads/elementor/forms/ for unexpected PHP or other rogue files and respond if they find indicators of compromise.
- Elementor Pro administrators: Check whether any published forms include File Upload fields with the multiple file upload option enabled; if so, update Elementor Pro immediately and review uploads in the forms directory. Elementor notified subscribers and reiterated that the multiple file upload option is disabled by default.
- Attackers: The flaw requires only a published form with the specific configuration; the predictability of filenames via uniqid() creates an avenue for timing brute-force or leveraging autoresponder emails to obtain the payload URL and trigger execution.
Patchstack’s advisory and Elementor’s notification together provide a clear operational path: update the plugin to the fixed release, audit the uploads directory for any PHP or unexpected files, and verify form configurations. Because the vulnerability hinges on a mismatch in how upload parts are validated versus processed, the fix required correcting that logic so that empty parts cannot be used as a staging step for malicious payloads.
For those responsible for WordPress hygiene, the immediate actions are narrow and specific — update to the patched Elementor Pro, examine wp-content/uploads/elementor/forms/ for rogue files, and remove any malicious artifacts discovered. Patchstack also recommends a thorough examination because updates do not retroactively remove files uploaded during the exposure period. As of the publisher’s report, no in-the-wild exploitation has been observed, but the underlying mechanics — a path from multipart handling to a publicly accessible uploads directory combined with time-based filename generation — create a textbook vector that defenders should close without delay.
Original story: https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/
