Critical vulnerability in Elementor Pro allows unauthenticated file upload and RCE

A critical vulnerability in the Elementor Pro WordPress plugin, identified as CVE-2026-32475, could allow attackers to upload executable files for remote code execution on the server, according to a report by Patchstack. The flaw affects Elementor Pro versions prior to 4.2.2, stemming from an issue in the File Upload module that mishandles empty filename uploads differently during validation and processing, Bleeping Computer reports.

The vulnerability arises from a discrepancy between two loops within the File Upload module: one for validation and one for processing. An attacker can exploit this by crafting a multipart upload with an empty filename in the first part, followed by a malicious PHP payload. The validation loop incorrectly dismisses the empty first part, while the processing step moves the PHP payload to a public directory (wp-content/uploads/elementor/forms/). Attackers can then determine the payload's filename, often through timing or autoresponder emails, and execute it by requesting the file's URL. This allows arbitrary code execution with the web server's privileges.

Elementor has released version 4.2.2 to address the issue, and administrators are urged to update immediately and scan their sites for malicious files. While no active exploitation has been observed, websites using Elementor Pro forms with the file upload feature enabled are at risk.

Source: Bleeping Computer