Critical Security Flaw Discovered in Elementor Pro Plugin
A significant vulnerability within the Elementor Pro WordPress plugin has been uncovered, potentially enabling malicious actors to upload executable files that could lead to remote code execution on the server.
Designated as CVE-2026-32475, this security lapse affects all Elementor Pro versions prior to 4.2.2. The origin of the issue lies within the File Upload module, where disparate loops for file validation and processing handle uploads with empty filenames inconsistently.
According to a report from Patchstack, a cybersecurity firm specializing in the WordPress environment, “The issue arises from a disagreement in handling an empty file entry (reported by PHP as UPLOAD_ERR_NO_FILE) between the validation and processing loops.”
The report further elucidates, “The validation loop and the processing loop employ differing early-exit logic for empty entries, allowing a carefully crafted multipart upload to be interpreted differently by the validator compared to the mover.”
An adversary could exploit this inconsistency by designing a multipart upload where the initial entry has a blank filename, succeeded by a nefarious PHP payload.
This sequence results in the validation routine exiting upon the first component, dismissing it as an UPLOAD_ERR_NO_FILE, thus neglecting the assessment of the subsequent entry.
Meanwhile, the processing phase acknowledges the empty entry’s absence and proceeds with the remaining upload, thereby relocating the PHP script embedded in the second section to a publicly accessible directory (wp-content/uploads/elementor/forms/).
Elementor Pro, the premium iteration of Elementor, a widely utilized drag-and-drop website builder for WordPress, boasts over 10 million active installations.
This Pro version proffers advanced functionalities, including form creation, theme and popup builders, custom code integration, CSS editing, and e-commerce capabilities, serving predominantly higher-tier platforms.
Patchstack reports that the exploitation of CVE-2026-32475 necessitates merely that the targeted site houses a published Elementor form featuring a File Upload field.
Researchers have indicated that, following the upload of the malicious PHP file, an attacker can ascertain its filename in the public directory because it is generated by the uniqid() function, which, being time-based, lacks randomness.
Through a timing brute-force method, attackers can discover the name of the payload. In specific configurations, they may obtain its exact URL via an autoresponder email.
Upon the attacker accessing the uploaded file through its URL, the server’s PHP interpreter executes its contents, thereby allowing arbitrary code to operate under the privileges of the web server.
Patchstack was made aware of CVE-2026-32475 on July 16 by researcher Tin Pham, who uncovered the vulnerability. The information was subsequently relayed to the Elementor development team.
By the following day, the plugin developers had prepared a remedy, which was validated by Patchstack on August 3 and released shortly thereafter.
Elementor has informed its user base regarding the vulnerability, clarifying that the risk pertains exclusively to “websites utilizing an Elementor Pro Form with an upload file form field, particularly when the multiple file upload option is activated (this option is disabled by default).”
“Every other Elementor site remains unaffected; however, we strongly recommend all sites upgrade to the latest version to mitigate potential security and compatibility issues,” the vendor asserts.
Site administrators are urged to upgrade to the most recent Elementor Pro release and to inspect the ‘wp-content/uploads/elementor/forms/’ directory for any PHP files or suspicious entries.
It is important to note that updating the plugin does not eliminate any malicious files that may have been uploaded during the period of vulnerability, necessitating a comprehensive investigation.
As of now, there have been no reports of active exploitation occurring in the wild.
Source link: Bleepingcomputer.com.
