Critical Security Vulnerability in Elementor Pro Plugin
A significant security vulnerability has been identified in the Elementor Pro WordPress plugin, posing a risk that unauthenticated attackers could potentially upload malicious PHP files and execute harmful code on compromised servers.
This vulnerability, cataloged as CVE-2026-32475, affects all Elementor Pro versions up to and including 4.2.1, with remediation provided in version 4.2.2.
Elementor Pro, a premium add-on for the Elementor page builder, includes a Forms widget that enables website proprietors to create diverse forms such as contact, job application, support, and document submission forms. The core issue resides within the File Upload field that permits users to attach files.
The vulnerability arises due to the separate handling of file validation and storage within distinct processes. Typically, Elementor Pro is designed to cross-reference uploaded file extensions against both an allowlist and a blocklist. Extensions deemed hazardous, such as .php, .phtml, .asp, and .exe, ought to be promptly rejected.
WordPress Plugin Vulnerability Explained
However, the implementation of these two processes diverges in how they treat empty file uploads. An attacker could exploit this flaw by submitting numerous file parts for a single upload attempt, inserting an empty file entry at the forefront followed by a malicious PHP file.
The validation routine ceases upon encountering the empty entry, thus neglecting the subsequent PHP file. Meanwhile, the file-processing routine bypasses the empty entry, erroneously proceeding to save the harmful file.
Consequently, this oversight allows an attacker to position a PHP payload within the publicly accessible Elementor forms upload directory.
If such a file is subsequently accessed via a web browser, the web server may execute it, granting the attacker remote code execution capabilities using the server’s permissions.
This exploit does not necessitate a WordPress account, any credentials, or administrator intervention. The sole prerequisite is the existence of a publicly accessible Elementor Pro Form widget that incorporates a File Upload feature.
Elementor has specified that enabling the multiple file upload option is also necessary, although this option is disabled by default. Administrators should prioritize updating Elementor Pro to version 4.2.2 or newer without delay.
The release addresses the disconnect between file validation and processing, introducing enhanced validation that occurs closer to the file transfer stage. However, merely updating is insufficient for websites that could be vulnerable.
This vulnerability was uncovered by security researcher Tin Pham, known as TF1T, and subsequently reported through Patchstack.
Patchstack has released mitigation guidelines for its clientele while Elementor worked to develop and deploy the security update on August 19, 2026.
Administrators are advised to examine the wp-content/uploads/elementor/forms/ directory for any unexpected PHP files or other executable content.
Any such suspicious files should be regarded as potential indicators of compromise and necessitate thorough investigation prior to removal.
Website owners should also scrutinize public upload forms, disable unnecessary file-upload capabilities, restrict the types of files that can be accepted, and inhibit PHP execution within WordPress upload directories.
While there had been no publicly reported instances of active exploitation at the time of this announcement, the unauthenticated nature of the flaw underscores the need for prompt patching.
Source link: Cybersecuritynews.com.
