As cited
Copy frozen at (site build).
vulnerabilities
Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
CVE-2026-32475 is a critical unauthenticated remote code execution vulnerability in Elementor Pro versions 4.2.1 and below, affecting the Forms module's File Upload field. The flaw stems from a logic mismatch between two separate loops that validate and process uploaded files: an empty file entry causes the validation loop to exit early and skip extension checks, while the processing loop continues and moves the malicious PHP file to a public directory. An unauthenticated attacker can exploit this by submitting two file parts with an empty first entry followed by a PHP payload, bypassing the extension blocklist and achieving remote code execution on any site with a published Elementor form containing a File Upload field.
Why it matters: Elementor Pro users running version 4.2.1 or earlier must immediately update to 4.2.2 or later, as any site with a public File Upload form is exposed to unauthenticated remote code execution; administrators should also scan wp-content/uploads/elementor/forms/ for suspicious files with executable extensions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
CVE-2026-32475 is a critical unauthenticated remote code execution vulnerability in Elementor Pro versions 4.2.1 and below, affecting the Forms module's File Upload field. The flaw stems from a logic mismatch between two separate loops that validate and process uploaded files: an empty file entry causes the validation loop to exit early and skip extension checks, while the processing loop continues and moves the malicious PHP file to a public directory. An unauthenticated attacker can exploit this by submitting two file parts with an empty first entry followed by a PHP payload, bypassing the extension blocklist and achieving remote code execution on any site with a published Elementor form containing a File Upload field.
Why it matters: Elementor Pro users running version 4.2.1 or earlier must immediately update to 4.2.2 or later, as any site with a public File Upload form is exposed to unauthenticated remote code execution; administrators should also scan wp-content/uploads/elementor/forms/ for suspicious files with executable extensions.
- Source published
- First seen by Cybersecurity Tracker