Cybersecurity experts have revealed a significant vulnerability in the Elementor Pro WordPress plugin, potentially allowing attackers to execute remote code. This flaw, identified as CVE-2026-32475, has been assigned a high severity with a CVSS score of 9.0, indicating the potential for unrestricted file uploads of dangerous types.
Details of the Vulnerability
This critical issue is situated within the Forms module’s File Upload field of Elementor Pro. The security company Patchstack notes that the flaw arises from separate handling of file extension verification and file movement into a public directory. By exploiting this separation, attackers can bypass security checks and upload PHP files into accessible directories.
Such exploitation enables attackers to potentially perform remote code execution on systems running affected versions of the plugin, specifically those prior to version 4.2.2. Notably, the vulnerability requires the presence of an Elementor page with a Form widget that includes a File Upload field, a common feature in various online forms.
Exploit Conditions and Patch Release
The vulnerability was discovered by security researcher Tin Pham, under the Patchstack Bug Bounty Program. Following the discovery, a patch was rapidly developed and released on August 19, 2026, just over a month after being reported to Elementor Pro, thereby updating the plugin to version 4.2.2.
This update follows a similar security concern addressed by WordPress in its core systems, which involved a different remote code execution vulnerability affecting versions 4.7 through 7.0. The WordPress update aimed to mitigate risks associated with malicious file uploads by adjusting how media files are processed.
Protection and Future Outlook
Users of WordPress and Elementor Pro are strongly advised to ensure that their plugins and core systems are updated to the latest versions to mitigate security risks. Regular scans for unauthorized changes and audits for unknown accounts are recommended practices to maintain site security.
These findings also align with broader cybersecurity threats, such as the StopAndProtect operation, which has compromised numerous WordPress sites for malicious activities. Proactive management of site security through updates and audits is crucial in preventing such vulnerabilities from being exploited.
