Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

# Critical Elementor Pro Flaw Lets Anyone Upload PHP Files — No Account Required

## The Threat

A critical vulnerability in Elementor Pro, one of the most widely deployed WordPress page-builder plugins on the internet, allows unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw, CVE-2026-32475, was discovered by security researcher Tin Pham (alias TF1T) and disclosed through Patchstack's bug bounty program.

The bug lives in the Forms module's File Upload field, and its root cause is a logic gap rather than a missing check. The extension blocklist is enforced in one loop; the actual file-move operation runs in a separate loop with different handling for empty entries. Submit two file parts for the same upload field — one empty, one a PHP file — and the extension check gets confused by the empty entry while the file-move step quietly writes your PHP payload to a publicly accessible directory at wp-content/uploads/elementor/forms/<uniqid>.php. The resulting file is immediately executable over the web.

What makes this especially dangerous is how ordinary the precondition is. An attacker needs only one published page containing an Elementor Form widget with a File Upload field. That configuration covers job application pages, support ticket forms, portfolio submissions, "attach your receipt" forms — the kind of pages Elementor Pro is built to create. No authentication, no special account, no hardened configuration to bypass. The plugin's default settings are enough.

## Severity and Impact

| Field | Detail |

|---|---|

| CVE | CVE-2026-32475 |

| CVSS Score | 9.0 / 10.0 (Critical) |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| CWE | CWE-434 — Unrestricted Upload of File with Dangerous Type |

| Patch Released | August 19, 2026 (version 4.2.2) |

## Affected Products

## Mitigations

Update immediately. Elementor Pro 4.2.2, released August 19, 2026, contains the patch. There is no safe workaround short of removing File Upload fields from all live forms or taking those pages offline.

For sites that cannot update immediately:

Additionally, if you're running WordPress core, patch separately for CVE-2026-65640 (CVSS 8.8), a distinct RCE flaw in WordPress 4.7 through 7.0.3 affecting sites using Imagick and Ghostscript where Author-level users can upload weaponized Postscript files disguised as images. That patch shipped in WordPress 7.0.4.

## References

---

## HackWire Analysis

This vulnerability follows a pattern that keeps appearing in PHP web application security and never gets old enough to stop catching developers off guard: split validation logic. The extension check and the file-move operation were written to handle the same data, but they weren't written together, and they don't fail together. That gap — a logic desynchronization rather than a missing check — is exactly the kind of flaw that passes code review. Someone looked at the extension blocklist and saw it was there. Someone else looked at the file-move code and saw it worked. Nobody ran a test case with two file parts for the same field name with an empty entry, because that's not a use case a form builder's QA team thinks to enumerate.

The timing here compounds the exposure. Patchstack reported this on July 16, 2026. The patch shipped August 19 — 34 days later. That's not an unreasonable disclosure timeline, but it means defenders have a narrow window before exploit code circulates widely. Elementor Pro claims over 10 million active installations; even if a fraction run forms with File Upload fields, the target pool is enormous.

The StopAndProtect campaign, disclosed simultaneously, is a pointed reminder of what happens to unpatched WordPress infrastructure at scale: compromised sites become nodes in someone else's distribution and C2 network. Organizations running Elementor Pro that haven't patched should treat this as an active threat, not a future risk. Scan your uploads directory for PHP files right now. If you find any you didn't put there, assume breach and work outward from that finding.

The broader lesson for WordPress developers: validation logic that touches the same data in multiple passes needs to be tested with adversarial inputs across every pass, not just the first one.

— HackWire Editorial

---

## Related Coverage