Elementor Pro Flaw Exposes WordPress Sites to Remote Code Execution
A critical vulnerability in the Elementor Pro plugin allows unauthenticated attackers to upload PHP files and execute code on affected systems.
A critical flaw in the Elementor Pro WordPress plugin has been disclosed, which could lead to remote code execution if successfully exploited. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0.
The flaw resides in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker can skip the extension blocklist entirely and write a PHP file into a public directory.
This discrepancy in how it validates the file's extension and moves the uploaded file to a public directory when empty file entries are processed turns a restricted file-upload field into an unauthenticated remote code execution primitive. Successful exploitation of the flaw could allow an attacker to upload arbitrary files, including PHP scripts, that could then be used to achieve remote code execution on affected systems.
The security defect impacts all versions of the plugin prior to and including version 4.2.1. The WordPress security company noted that the only precondition required to pull off an attack is that the target site has at least one published Elementor page containing a Form widget with a File Upload field.
The uploaded file is written as "wp-content/uploads/elementor/forms/
Security researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw under the Patchstack Bug Bounty Program. After the issue was reported to Elementor Pro on July 16, 2026, a patch (version 4.2.2) was released on August 19.
The release comes a little over a week after WordPress released 7.0.4 to address a high-severity security issue (CVE-2026-65640, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Author-level user or higher. However, for the attack to be successful, two conditions have to be satisfied:
| Condition | Description | | --- | --- | | 1 | Imagick and Ghostscript in use on the server | | 2 | A malicious user with the upload_files capability |
The update "changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a logged-in author turn an ordinary-looking image upload into code execution on your server," Patchstack said.
If you run a multi-author publication, a membership site, a client site with contributors, or anything with open or loosely managed registration, that bar is a lot lower than it sounds. On those sites, an Author uploading a booby-trapped 'image' is a genuinely realistic threat, not a theoretical one. If it's just you and a tightly held set of trusted editors, your exposure is smaller.
The findings also coincide with the discovery of a large-scale operation dubbed StopAndProtect that's turning thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.
WordPress users are advised to keep their websites and plugins up-to-date, scan for unauthorized modifications that serve unexpected redirects or pop-ups, and audit them for unknown accounts and plugins.
## Patch Released for Elementor Pro Flaw
A patch has been released for the Elementor Pro flaw, which addresses the vulnerability and prevents remote code execution. The patch is available for all versions of the plugin prior to and including version 4.2.1.
## WordPress Users Advised to Take Action
WordPress users are advised to take action to protect their websites from the Elementor Pro flaw. This includes keeping their websites and plugins up-to-date, scanning for unauthorized modifications, and auditing for unknown accounts and plugins.
## Large-Scale Operation Discovered
The findings also coincide with the discovery of a large-scale operation dubbed StopAndProtect that's turning thousands of compromised WordPress websites into a distributed infrastructure for malware delivery, command-and-control communications, and the storage of stolen data.
