CVE-2026-32475: Elementor Pro Form Upload Unauthenticated PHP Write RCE; 10–20 Million WordPress Sites Worldwide Face Takeover

The Elementor Pro Forms file-upload flaw CVE-2026-32475, disclosed 19 August 2026, lets unauthenticated attackers bypass the extension blacklist, write PHP into the web root, and execute arbitrary code. CVSS 9.0–9.8. Tens of millions of WordPress sites in scope.

On 19 August 2026, WordPress security firm Patchstack publicly disclosed a file-upload vulnerability in the Elementor Pro Forms module, CVE-2026-32475. Unauthenticated attackers can bypass Elementor Pro's file-extension blacklist and write executable PHP directly to wp-content/uploads/elementor/forms/ via a crafted multipart form POST, then trigger remote code execution. Elementor Pro shipped 4.2.2 the same day. Patchstack scored CVSS 9.0; Wordfence independently scored 9.8. Highest-priority WordPress-ecosystem vuln of August 2026.

Incident Overview

Elementor Pro is the page builder on 10–20 million WordPress sites. Nearly every page that uses the Elementor Pro Forms component with a File Upload field enabled (job applications, support tickets, customer file submissions, photo contests, etc.) is in scope. Root cause is inconsistent handling of two loops in the Forms file-upload field: the validation loop `return`s on UPLOAD_ERR_NO_FILE empty items and exits the whole function; the processing loop `continue`s on the same empty item and skips it. Semantic mismatch lets an attacker place a malicious .php file as the second file part of the same field and skip extension checks.

Technical Details

CVE-2026-32475 involves the flow in modules/forms/fields/upload.php:

• Validation phase (`validation()`): iterates all upload entries; on UPLOAD_ERR_NO_FILE calls return, aborting the entire function and skipping later entries.
• Processing phase (`process_field()`): iterates the same upload entries; on UPLOAD_ERR_NO_FILE calls continue, skipping the empty entry and processing a subsequent .php file.
• Attacker crafts multipart/form-data: first file part of the same form field left empty, second file part holds .php webshell content. Validation hits the empty item, returns, and the extension blacklist is fully bypassed.
• Written filename is PHP `uniqid()`, a 13-digit hex timestamp. Attacker can enumerate the uploaded name around request time.
• Write directory wp-content/uploads/elementor/forms/ executes PHP by default. Hitting the upload URL runs the PHP—equivalent to a webshell.

In a live attack, the attacker requests wp-content/uploads/elementor/forms/<file>.php for code execution, then:

• Plants a persistent webshell (named as random characters under wp-content), or injects payload into existing plugin/theme code;
• Reads wp-config.php for DB credentials, connects to the WordPress database, writes a new admin account;
• Redirects the site to malware distribution, SEO-spam pools, or phishing landing pages;
• Attempts lateral movement to other internal systems as the web-server process.

Impact Assessment

Severity:

• AV:N (network), AC:H (exploitable only when a Form field is published), PR:N (no privileges), UI:N (no user interaction), C:H/I:H/A:H → CVSS v3.1 9.8, CVSS v4.0 9.0.
• Per Patchstack and BleepingComputer, no public weaponized PoC as of 19 August. Historically, Elementor's 2023 free-plugin critical RCE saw public scanning hours after disclosure.

Exploit condition is one public Elementor Pro page with a Form widget + File Upload field. The upload field need not be marked required (default is not required)—the most common live WordPress configuration.

Fix and Mitigation

Official fix: Elementor Pro 4.2.2 (shipped 19 August). Key changes:

• Sync the validation loop and the processing loop so extension checks run immediately before file write, not as a bypassable pre-check.
• Strong checks at the file-move site; no write-to-disk after a passed extension check that can still be skipped.

Sites that cannot upgrade immediately:

• Web-server rules on wp-content/uploads/elementor/forms/ (Nginx: `location` deny PHP; Apache: `.htaccess` remove PHP handler).
• Temporarily delete all public Elementor forms with File Upload enabled, or switch the Form widget to the Classic Editor version.
• Hunt wp-content/uploads/elementor/forms/ for suspicious .php that is not image/PDF. Search ops logs for GET/POST against that directory.
• Confirm the Elementor Pro license is active and auto-updates are on; unlicensed sites routinely miss security patches.
• Force-rotate all wp-admin passwords, the DB password in wp-config.php, and object-storage / mail SMTP keys.

Additional Notes

Elementor Pro 4.2.2 also ships a tighter extension allowlist (restrict to png/jpg/pdf or whatever the business actually needs). Enable WAF upload-directory rules in parallel. Given WordPress-ecosystem dependence on Elementor Pro, finish bulk upgrades within 24–48 hours of the patch. Multi-site operators can roll via wp-cli or the host panel bulk-upgrade function.

References

• Falcon Internet: CVE-2026-32475 Elementor Pro File Upload Flaw
• OP Innovate: Elementor Pro CVE-2026-32475 Unauthenticated File Upload RCE
• HackersRadar: CVE-2026-32475 Elementor Pro File Upload Vulnerability
• CyberSecBrief Daily Cybersecurity Briefing (21 August 2026)
• GajShield Knowledge Base: Critical Elementor Pro bug