CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Permanent story citation

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 5819

As cited

Copy frozen at (site build).

vulnerabilities

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

CVE-2026-32475 is a critical unauthenticated remote code execution vulnerability in Elementor Pro versions 4.2.1 and below, affecting the Forms module's File Upload field. The flaw stems from a logic mismatch between two separate loops that validate and process uploaded files: an empty file entry causes the validation loop to exit early and skip extension checks, while the processing loop continues and moves the malicious PHP file to a public directory. An unauthenticated attacker can exploit this by submitting two file parts with an empty first entry followed by a PHP payload, bypassing the extension blocklist and achieving remote code execution on any site with a published Elementor form containing a File Upload field.

Why it matters: Elementor Pro users running version 4.2.1 or earlier must immediately update to 4.2.2 or later, as any site with a public File Upload form is exposed to unauthenticated remote code execution; administrators should also scan wp-content/uploads/elementor/forms/ for suspicious files with executable extensions.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

CVE-2026-32475 is a critical unauthenticated remote code execution vulnerability in Elementor Pro versions 4.2.1 and below, affecting the Forms module's File Upload field. The flaw stems from a logic mismatch between two separate loops that validate and process uploaded files: an empty file entry causes the validation loop to exit early and skip extension checks, while the processing loop continues and moves the malicious PHP file to a public directory. An unauthenticated attacker can exploit this by submitting two file parts with an empty first entry followed by a PHP payload, bypassing the extension blocklist and achieving remote code execution on any site with a published Elementor form containing a File Upload field.

Why it matters: Elementor Pro users running version 4.2.1 or earlier must immediately update to 4.2.2 or later, as any site with a public File Upload form is exposed to unauthenticated remote code execution; administrators should also scan wp-content/uploads/elementor/forms/ for suspicious files with executable extensions.

VendorsWordPress
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary