A significant security weakness has been identified in the Elementor Pro WordPress plugin, potentially enabling unauthorized attackers to upload harmful PHP files and execute code on compromised servers.
Details of the Vulnerability
The vulnerability, tracked as CVE-2026-32475, impacts Elementor Pro versions up to 4.2.1. It has been addressed in version 4.2.2. Elementor Pro is an add-on for the Elementor page builder, widely used for creating various web forms such as contact and support forms. The weakness lies within the File Upload field of the Forms widget.
The issue arises from how the plugin handles file validation and storage processes. Normally, it checks file extensions against specified allowlists and blocklists, rejecting dangerous extensions like .php and .exe. However, the flaw allows attackers to bypass this validation under certain conditions.
Exploitation Method and Impact
The vulnerability can be exploited by submitting multiple file parts in a single upload, with an empty file entry first followed by a malicious PHP file. The validation process stops at the empty entry, missing the harmful file, which is then processed and saved.
This enables attackers to potentially place a PHP file in the Elementor forms upload directory, which could be executed by the server if accessed, granting remote code execution rights.
Preventative Measures and Recommendations
Exploitation does not require any WordPress credentials or administrative actions. It primarily demands an accessible Elementor Pro Form widget with the File Upload feature enabled. Elementor advises updating to version 4.2.2 to rectify the issue. This version improves file validation and processing.
Administrators are urged to inspect the wp-content/uploads/elementor/forms/ directory for unexpected executable files. Security researcher Tin Pham initially discovered the flaw, leading to a swift response from Elementor and Patchstack.
Though no active exploits have been reported, the unauthenticated nature of the vulnerability necessitates prompt updates. Site owners should also review their public forms, disable unnecessary uploads, limit accepted file types, and prevent PHP execution in upload directories to enhance security.
Stay informed and protect your digital assets by integrating threat intelligence systems within your security operations center.
.webp?ssl=1 "Telnyx Python SDK Backdoored by Hackers to Steal Credentials")
