Critical Elementor Pro Flaw Enables Unauthenticated Remote Code Execution

Cybersecurity researchers at Patchstack have disclosed a critical vulnerability in the Elementor Pro WordPress plugin that allows unauthenticated attackers to upload PHP files and execute arbitrary code on affected servers. Tracked as CVE-2026-32475, the flaw carries a CVSS score of 9.0 out of 10.0, placing it in the "critical" severity tier. The discovery was credited to security researcher Tin Pham (aka TF1T) under the Patchstack Bug Bounty Program.

The vulnerability resides in the Forms module's File Upload field, where the extension check and the file-move operation run in two separate loops with inconsistent handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker can bypass the extension blocklist entirely and write a PHP file into a public directory at "wp-content/uploads/elementor/forms/.php," where is generated by PHP's uniqid() function. The only precondition for exploitation is that the target site hosts at least one published Elementor page containing a Form widget with a File Upload field, a configuration Patchstack described as "extremely common" across job-application forms, ID upload forms, and support-ticket attachments.

The security defect impacts all versions of Elementor Pro up to and including version 4.2.1. After Tin Pham reported the issue on July 16, 2026, Elementor released the patched version 4.2.2 on August 19. Site administrators are urged to update immediately and audit their port scanner results to confirm no unauthorized web shells have already been deployed in publicly accessible directories.

The disclosure comes shortly after WordPress 7.0.4 patched another high-severity flaw, CVE-2026-65640 (CVSS 8.8), enabling remote code execution via malicious Postscript file uploads when ImageMagick and Ghostscript are active on the server. Together, the two vulnerabilities underscore the risks of running outdated CMS components and unverified plugins. Operators running multi-author WordPress installations should also verify their TLS configuration with an SSL/TLS checker and rotate any admin credentials that may have been exposed, ideally validated through a password checker to ensure no compromised keys remain in use.