Unauthenticated Remote Code Execution in Elementor Pro

Security researchers have identified a critical vulnerability, tracked as CVE-2026-32475, affecting the Elementor Pro WordPress plugin. The flaw resides in the Forms module's File Upload field, where an improper validation sequence allows attackers to bypass extension blocklists. By submitting two file parts for the same field, an unauthenticated attacker can effectively neutralize the extension check and move a malicious PHP file into a public directory. The resulting file is written to 'wp-content/uploads/elementor/forms/<uniqid>.php'.

Successful exploitation allows for unauthenticated remote code execution. The vulnerability impacts all plugin versions up to and including 4.2.1. This is particularly dangerous due to the ubiquity of Elementor Form widgets with file upload functionality enabled across WordPress installations. Furthermore, a secondary, distinct vulnerability in WordPress core (CVE-2026-65640) was disclosed, which allows for RCE via malicious Postscript files, though this requires higher-privileged access compared to the Elementor flaw.

Attack Chain

1. Attacker identifies a WordPress site running a vulnerable version of Elementor Pro (<= 4.2.1).
2. Attacker locates a public-facing page containing an Elementor Form widget with a File Upload field.
3. Attacker crafts a multipart HTTP request targeting the File Upload field.
4. Attacker submits the request containing two file parts for the same field to trigger the validation logic discrepancy.
5. The plugin fails to correctly validate the second file part, allowing the PHP file to pass the blocklist check.
6. The application writes the malicious PHP script to the public web-accessible directory 'wp-content/uploads/elementor/forms/'.
7. Attacker requests the newly created .php file via a direct HTTP GET request.
8. Web server executes the attacker's script, resulting in arbitrary code execution.

Impact

Successful exploitation results in full unauthenticated remote code execution on the underlying web server. This allows attackers to gain persistent access, exfiltrate site data, and potentially pivot into the internal network. Given the high prevalence of Elementor Pro, the potential victim count is significant across various sectors hosting WordPress-based web applications.

Recommendation

• Immediately update Elementor Pro to version 4.2.2 or higher to address CVE-2026-32475.
• Audit 'wp-content/uploads/elementor/forms/' for any unauthorized .php files.
• Update WordPress core to version 7.0.4 or higher to mitigate the secondary RCE risk associated with CVE-2026-65640.
• Deploy the provided Sigma rule to detect unexpected .php file creation within the Elementor forms directory.