CVE-2026-32475, a vulnerability in the Elementor Pro WordPress plugin rated CVSS 9.0 out of 10.0, can be turned into unauthenticated remote code execution by writing PHP into a public uploads directory.
CVE-2026-32475: the mechanics in plain terms
Researchers at Patchstack and security researcher Tin Pham (aka TF1T) describe the flaw as an instance of "unrestricted upload of a file with a dangerous type." Patchstack explains the root cause as a logic discrepancy inside Elementor Pro's Forms module: "the extension check and the file-move step run in two separate loops with different handling of empty file entries." By submitting two file parts for the same File Upload field, "an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory."
The uploaded file is written to a predictable path: "wp-content/uploads/elementor/forms/<uniqid>.php," where "<uniqid>" is the output of PHP's uniqid() function. Because the exploit requires no authentication and targets a commonly used form field, Patchstack calls this path to execution a straightforward unauthenticated remote code execution primitive when successfully executed.
Scope: affected versions and required site conditions
The defect impacts all Elementor Pro versions prior to and including 4.2.1. Patchstack sets out the only precondition for exploitation: the target site must have at least one published Elementor page that contains a Form widget with a File Upload field. Patchstack notes how common that configuration is in practice—examples cited include job-application forms, ID/photo attachments, receipts, and support-ticket uploads—and that the field's "Required" toggle being off is its default state, so no unusual configuration is necessary.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDisclosure and remediation timeline
Security researcher Tin Pham reported the issue to Elementor Pro under the Patchstack Bug Bounty Program on July 16, 2026. Elementor issued a patch in release 4.2.2 on August 19, 2026. The researcher is credited by name in the disclosure record accompanying the fix.
Context: simultaneous WordPress core advisory and active abuse campaigns
The Elementor disclosure follows a recent WordPress core update. On August 12, WordPress released 7.0.4 to address a separate high-severity vulnerability, CVE-2026-65640 (CVSS 8.8), which enables remote code execution through a malicious Postscript file upload by a user with the upload_files capability. That WordPress fix included a note that exploitation required Imagick and Ghostscript on the server and a malicious user with upload_files privileges—conditions that lower the barrier on multi-author, membership, or loosely managed sites.
At the same time, researchers have disclosed a large-scale operation called StopAndProtect that is turning thousands of compromised WordPress websites into infrastructure for malware delivery, command-and-control communications, and storage of stolen data, a backdrop that increases the practical stakes of remote code execution in the WordPress ecosystem.
What this means for security teams, site owners, and end users
- Security teams and technologists: prioritize an immediate inventory for any published Elementor page containing a Form widget with a File Upload field, and apply the Elementor Pro 4.2.2 patch. Scan uploads and the directory "wp-content/uploads/elementor/forms/" for unexpected .php files named with uniqid-style patterns.
- Site owners and administrators: update affected plugins to 4.2.2, and follow the general remediation advice Patchstack published—keep sites and plugins up to date, scan for unauthorized modifications that serve unexpected redirects or pop-ups, and audit for unknown accounts and plugins.
- End users and editors on multi-author sites: be aware of the heightened risk where multiple contributors can upload files; the related WordPress advisory notes that multi-author or loosely managed registrations lower the barrier to exploitation because an author-level account can be leveraged in the Postscript-based attack scenario.
Elementor Pro site operators face a narrow window to act: the flaw requires only a standard form configuration and produces files in a predictable place on disk, and a patch is already available. The combination of an unauthenticated upload primitive, widespread use of File Upload fields, and active campaigns abusing compromised WordPress sites makes speedy patching and targeted scanning — not debate — the immediate next step.
https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
