Ethical Hacking News
A critical flaw in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload PHP and execute code, posing a significant risk to users. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0 and affects all versions of the plugin prior to and including version 4.2.1. A patch was released on August 19, but users are advised to keep their websites and plugins up-to-date to avoid potential attacks.
Elementor Pro WordPress plugin has a critical vulnerability (CVE-2026-32475) that allows remote code execution with a CVSS score of 9.0 out of 10.0. The vulnerability resides in the Forms module's File Upload field and can be exploited by submitting two file parts for the same field. The affected versions of the plugin are prior to and including version 4.2.1. Unauthenticated attackers can upload arbitrary files, including PHP scripts, to achieve remote code execution on affected systems. Only a published Elementor page with a Form widget containing a File Upload field is required to exploit the vulnerability. A patch (version 4.2.2) has been released to address the issue. WordPress users are advised to keep their websites and plugins up-to-date, scan for unauthorized modifications, and audit their accounts and plugins.
A recent discovery by cybersecurity researchers has highlighted a critical vulnerability in the popular Elementor Pro WordPress plugin, which, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0, indicating that it is a high-severity issue that poses a significant risk to users.
According to cybersecurity experts, the flaw resides in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries. This discrepancy in how it validates the file's extension and moves the uploaded file to a public directory turns a restricted file-upload field into an unauthenticated remote code execution primitive.
The Forms module is a widely used component in Elementor Pro, and its vulnerability affects all versions of the plugin prior to and including version 4.2.1. The security defect impacts all websites that use the plugin, regardless of whether they are hosted on a content management system (CMS) or built from scratch.
The researchers discovered that an unauthenticated attacker could exploit this vulnerability by submitting two file parts for the same field. By doing so, they could skip the extension blocklist entirely and write a PHP file into a public directory. This would enable the attacker to upload arbitrary files, including PHP scripts, that could then be used to achieve remote code execution on affected systems.
The WordPress security company noted that the only precondition required to pull off an attack is that the target site has at least one published Elementor page containing a Form widget with a File Upload field. The uploaded file is written as "wp-content/uploads/elementor/forms/.php," where "" is the output of PHP's uniqid() function.
This configuration is extremely common, and it is used in job-application forms, 'attach a photo/ID/receipt' forms, and support-ticket attachments. The field's 'Required' toggle being off is its default state, so no hardened or unusual setting is needed.
Security researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw under the Patchstack Bug Bounty Program. After the issue was reported to Elementor Pro on July 16, 2026, a patch (version 4.2.2) was released on August 19.
The release comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Author-level user or higher. However, for the attack to be successful, two conditions have to be satisfied - Imagick and Ghostscript in use on the server, given the issue is in Ghostscript's handling of certain embedded files.
A malicious user with the upload_files capability is also required to exploit the vulnerability. The update "changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your server," Patchstack said.
"If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, that bar is a lot lower than it sounds. On those sites, an Author uploading a booby-trapped 'image' is a genuinely realistic threat, not a theoretical one. If it's just you and a tightly held set of trusted editors, your exposure is smaller," the security company noted.
The findings also coincide with the discovery of a large-scale operation dubbed StopAndProtect that's turning thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.
WordPress users are advised to keep their websites and plugins up-to-date, scan for unauthorized modifications that serve unexpected redirects or pop-ups, and audit them for unknown accounts and plugins.
Related Information:
https://www.ethicalhackingnews.com/articles/Elementor-Pro-Flaw-Allows-Unauthenticated-Attackers-to-Upload-PHP-and-Execute-Code-ehn.shtml
https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor-pro/elementor-pro-421-unauthenticated-arbitrary-file-upload-via-upload-field-array-validation-bypass
https://nvd.nist.gov/vuln/detail/CVE-2026-32475
https://www.cvedetails.com/cve/CVE-2026-32475/
https://nvd.nist.gov/vuln/detail/CVE-2026-65640
https://www.cvedetails.com/cve/CVE-2026-65640/
Published: Thu Aug 20 01:47:22 2026 by llama3.2 3B Q4_K_M
