Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Summary: Researchers disclosed a critical flaw in the Elementor Pro WordPress plugin, tracked as CVE-2026-32475 with a CVSS score of 9.0, in which the Forms module's File Upload field runs its extension check and file-move step in two separate loops with different handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist and writes a PHP file into a public directory, affecting all versions up to and including 4.2.1, with a patch released as version 4.2.2 on August 19, 2026, after the issue was reported on July 16.
Bottom line: The only precondition is a published Elementor page with a Form widget containing a File Upload field - job-application forms, photo or ID attachments, and support-ticket uploads all qualify, and the field's Required toggle is off by default, so no hardened setting is needed. An unauthenticated attacker who reaches such a form can write a PHP file to a public directory and execute code on the server.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-32475CVE-2026-65640
- Related