{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-32475/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9,"id":"CVE-2026-32475"},{"cvss":8.8,"id":"CVE-2026-65640"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elementor Pro (4.2.1)","WordPress Core (7.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","remote-code-execution","cve-2026-32475"],"_cs_type":"advisory","_cs_vendors":["Elementor","WordPress"],"content_html":"\u003cp\u003eSecurity researchers have identified a critical vulnerability, tracked as CVE-2026-32475, affecting the Elementor Pro WordPress plugin. The flaw resides in the Forms module's File Upload field, where an improper validation sequence allows attackers to bypass extension blocklists. By submitting two file parts for the same field, an unauthenticated attacker can effectively neutralize the extension check and move a malicious PHP file into a public directory. The resulting file is written to 'wp-content/uploads/elementor/forms/\u0026lt;uniqid\u0026gt;.php'.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution. The vulnerability impacts all plugin versions up to and including 4.2.1. This is particularly dangerous due to the ubiquity of Elementor Form widgets with file upload functionality enabled across WordPress installations. Furthermore, a secondary, distinct vulnerability in WordPress core (CVE-2026-65640) was disclosed, which allows for RCE via malicious Postscript files, though this requires higher-privileged access compared to the Elementor flaw.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running a vulnerable version of Elementor Pro (\u0026lt;= 4.2.1).\u003c/li\u003e\n\u003cli\u003eAttacker locates a public-facing page containing an Elementor Form widget with a File Upload field.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a multipart HTTP request targeting the File Upload field.\u003c/li\u003e\n\u003cli\u003eAttacker submits the request containing two file parts for the same field to trigger the validation logic discrepancy.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to correctly validate the second file part, allowing the PHP file to pass the blocklist check.\u003c/li\u003e\n\u003cli\u003eThe application writes the malicious PHP script to the public web-accessible directory 'wp-content/uploads/elementor/forms/'.\u003c/li\u003e\n\u003cli\u003eAttacker requests the newly created .php file via a direct HTTP GET request.\u003c/li\u003e\n\u003cli\u003eWeb server executes the attacker's script, resulting in arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthenticated remote code execution on the underlying web server. This allows attackers to gain persistent access, exfiltrate site data, and potentially pivot into the internal network. Given the high prevalence of Elementor Pro, the potential victim count is significant across various sectors hosting WordPress-based web applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update Elementor Pro to version 4.2.2 or higher to address CVE-2026-32475.\u003c/li\u003e\n\u003cli\u003eAudit 'wp-content/uploads/elementor/forms/' for any unauthorized .php files.\u003c/li\u003e\n\u003cli\u003eUpdate WordPress core to version 7.0.4 or higher to mitigate the secondary RCE risk associated with CVE-2026-65640.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect unexpected .php file creation within the Elementor forms directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T07:09:14Z","date_published":"2026-08-20T07:09:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-elementor-rce/","summary":"Elementor Pro versions 4.2.1 and below contain a critical file upload vulnerability (CVE-2026-32475) that allows unauthenticated attackers to achieve remote code execution by bypassing extension validation.","title":"Unauthenticated Remote Code Execution in Elementor Pro","url":"https://feed.craftedsignal.io/briefs/2026-08-elementor-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-32475","version":"https://jsonfeed.org/version/1.1"}