CVE-2026-32475: Elementor Pro File Upload Vulnerability

CVE-2026-32475 Overview

CVE-2026-32475 is an unrestricted file upload vulnerability in the Elementor Pro plugin for WordPress. The flaw affects all Elementor Pro versions up to and including 4.2.1. Attackers can upload files with dangerous types without authentication, enabling remote code execution on the underlying web server. The weakness is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Patchstack published a technical writeup describing the path from unauthenticated file upload to full RCE. See the Patchstack advisory on Elementor Pro for background.

Critical Impact
Unauthenticated attackers can upload malicious files and achieve remote code execution on WordPress sites running Elementor Pro through version 4.2.1.

Affected Products

Elementor Pro plugin for WordPress
All versions from initial release through 4.2.1
WordPress sites where Elementor Pro is installed and active

Discovery Timeline

2026-08-19 - CVE-2026-32475 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-32475

Vulnerability Analysis

The vulnerability resides in an Elementor Pro file upload handler that fails to validate the type of uploaded files. An unauthenticated attacker can submit a request containing a file with a dangerous extension, such as a PHP script. The server accepts the file and stores it within a web-accessible directory. The attacker then requests the uploaded file directly to execute arbitrary PHP code in the WordPress process context.

Exploitation grants attackers the same privileges as the PHP-FPM or web server user. From this position, attackers can read WordPress secrets from wp-config.php, pivot to the database, deploy webshells, and establish persistence. The Patchstack vulnerability record documents the affected upload endpoint.

The EPSS score is 0.416% at the 34.965 percentile as of 2026-08-20, indicating moderate short-term exploitation probability that may rise as public exploit tooling matures.

Root Cause

The root cause is missing or insufficient MIME type and extension validation in Elementor Pro's file upload logic. The handler does not enforce an allowlist of safe file types before writing the uploaded content to disk. It also does not require authentication or capability checks before invoking the upload routine. This combination lets an unauthenticated attacker place executable PHP files inside the WordPress uploads directory.

Attack Vector

The attack vector is the network. An attacker sends a crafted multipart HTTP POST request to the vulnerable upload endpoint exposed by Elementor Pro. The request includes a payload file with a PHP extension or double extension that bypasses weak filters. Once the server writes the file to a public directory, the attacker requests the file URL to trigger PHP execution. No user interaction and no valid WordPress account are required.

Refer to the Patchstack technical writeup for a detailed description of the request structure and the affected code path.

Detection Methods for CVE-2026-32475

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files inside wp-content/uploads/ or Elementor upload directories
Web server access logs showing POST requests to Elementor Pro upload endpoints from unauthenticated sessions followed by GET requests to newly created files
Outbound network connections from the PHP process to unfamiliar IP addresses or command-and-control domains
Modified WordPress core files, unexpected admin users, or newly scheduled wp-cron events

Detection Strategies

Scan WordPress upload directories for executable file extensions and hash them against known webshell signatures
Alert on HTTP POST requests to Elementor Pro endpoints with Content-Type: multipart/form-data from unauthenticated clients
Correlate file creation events in wp-content/uploads/ with subsequent GET requests to the same path
Monitor PHP process telemetry for spawning of shell interpreters such as sh, bash, or python

Monitoring Recommendations

Enable file integrity monitoring on all WordPress directories, especially wp-content/uploads/ and wp-content/plugins/elementor-pro/
Forward web server and PHP-FPM logs to a centralized SIEM for retention and correlation
Track outbound egress from web server hosts and alert on connections to non-approved destinations

How to Mitigate CVE-2026-32475

Immediate Actions Required

Update Elementor Pro to a version later than 4.2.1 as soon as the vendor publishes a fixed release
Audit wp-content/uploads/ for unauthorized PHP files and remove any that are not part of a legitimate deployment
Rotate WordPress administrator passwords, database credentials, and API keys stored in wp-config.php if compromise is suspected
Review WordPress user tables for unexpected accounts with administrator role

Patch Information

Consult the Patchstack advisory for Elementor Pro for the fixed version once available. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release. Verify the plugin version reported in wp-admin matches the patched build after deployment.

Workarounds

Disable Elementor Pro until a patched version is installed if the site cannot be updated immediately
Block requests to Elementor Pro upload endpoints at the web application firewall for unauthenticated clients
Configure the web server to deny PHP execution inside wp-content/uploads/ using directives such as php_flag engine off in Apache or a location block in nginx that returns 403 for \.php$ under the uploads path
Restrict write permissions on the uploads directory to the minimum required by the web server user

bash

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}