Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
PoC publicElementor ProOur summary
A critical unauthenticated remote code execution vulnerability (CVE-2026-32475) affecting the Elementor Pro plugin for WordPress has been patched in version 4.2.2, following the release of a public proof-of-concept. The flaw resides in the Forms module's File Upload field, where a logic discrepancy between validation and processing loops allows attackers to bypass extension blocklists by submitting empty file entries alongside malicious PHP payloads.
This issue enables unauthenticated visitors to place executable scripts in public directories if a form with an optional file upload is present, leading to full server compromise. Site administrators are urged to update immediately and review the wp-content/uploads/elementor/forms/ directory for any unexpected PHP files that may have been deployed prior to the patch.
Below is the opening; the full story is at Patchstack.
From Patchstack
Elementor Pro
Unauthenticated Arbitrary File Upload to Remote Code Execution
This blog post is about an unauthenticated arbitrary file upload vulnerability in the Elementor Pro plugin that leads to remote code execution. The flaw lives in the Forms module’s File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory. Patchstack has issued mitigation rules to protect against exploitation of this vulnerability.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.