Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

1. Executive summary

CVE-2026-32475 is a CWE-434 unrestricted-file-upload vulnerability affecting Elementor Pro versions up to and including 4.2.1; Elementor released fixed version 4.2.2 on 19 August 2026. The vulnerability has an authoritative CVSS score of 9.0, severity CRITICAL, and is NOT in CISA KEV. An unauthenticated attacker can reportedly bypass the Forms module’s extension blocklist and place a PHP file in a web-accessible directory when a published Elementor page contains a Form widget with a File Upload field. EMEA financial-services organisations with this configuration should update within 24 hours, although the exploit mechanics are single-sourced and the supplied material contains no confirmed exploitation, payloads or atomic indicators.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

CVE-2026-32475 is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) with CVSS 9.0 CRITICAL severity. It is NOT in CISA KEV. The supplied reporting describes a viable unauthenticated remote-code-execution primitive but does not document an exploited client, in-the-wild activity or a public proof of concept.

Confirmed within the supplied vulnerability reporting—not confirmed as an observed intrusion—the attack path is:

1. A target exposes at least one published Elementor page containing a Form widget with a File Upload field. No account is required. The field’s Required option is reportedly disabled by default.
2. The attacker submits two file parts for the same upload field. Processing of empty file entries differs between the extension-validation loop and the subsequent file-move loop.
3. This inconsistency allows the request to bypass the extension blocklist while the move operation still processes the attacker-controlled file.
4. A PHP file is written to the public directory:

wp-content/uploads/elementor/forms/<uniqid>.php

The <uniqid> component is generated using PHP’s uniqid() function.

5. The uploaded PHP script can then be used to execute attacker-supplied code through the affected web application.

Defensive scope

• Affected product: Elementor Pro for WordPress.
• Affected versions: All versions up to and including 4.2.1.
• Fixed version: 4.2.2, released 19 August 2026.
• Vulnerable component: Forms module, specifically the Form widget’s File Upload field.
• Authentication: None required.
• Exposure condition: At least one published Elementor page must contain the vulnerable field.
• Vulnerability mechanism: Separate extension-checking and file-move loops handle empty multipart entries inconsistently.
• Result: Arbitrary-file upload, including PHP, creating an unauthenticated remote-code-execution path.
• Execution context: The resulting operating-system or PHP privilege context is not specified.
• Protocols and endpoints: The exact HTTP endpoint, parameter name, request structure and ports are not provided.

No malicious PHP sample, hash, command, persistence mechanism, privilege-escalation method, command-and-control infrastructure, lateral-movement activity, data access, exfiltration or observed operational impact is available. Data theft, extortion or ransomware must therefore not be inferred.

The technical mechanics, affected configuration and destination path are single-sourced through The Hacker News quoting Patchstack. Verify request-level signatures in a representative environment before enforcement. The article’s separate reference to the StopAndProtect operation does not establish that it exploited CVE-2026-32475; any such attribution is unconfirmed, and no corresponding MITRE actor profile is present in the verified reference data.

4. Mitigation & containment

P1 — within 24 hours

1. Upgrade Elementor Pro to version 4.2.2 or later. Verify the installed version on every public WordPress instance after deployment. The supplied material provides no vendor workaround equivalent to upgrading.
2. Inventory published Elementor pages containing a Form widget with a File Upload field. Prioritise internet-facing recruitment, identity-document, receipt, support-ticket and attachment forms.
3. Where immediate updating is impossible, temporarily unpublish the affected page or remove/disable its File Upload field. Disabling the Required option is not a security control; it is reported as the default configuration.
4. Apply a web-server control preventing PHP interpretation beneath wp-content/uploads/, particularly wp-content/uploads/elementor/forms/. Validate the control against required application behaviour before production enforcement.
5. If an unexplained PHP file is found in that directory, remove the affected instance from public service, preserve the file and relevant telemetry, and treat the system as potentially compromised. Do not delete the artefact before collecting its hash, timestamps, ownership and content.

P2 — within 72 hours

1. Search the full available filesystem and file-event retention for PHP files created beneath:

wp-content/uploads/elementor/forms/

2. Review reverse-proxy, CDN, WAF and raw web-request records for:

• Multipart requests containing two file parts for the same Elementor upload field.
• Empty file parts mixed with a PHP upload.
• Requests referencing .php objects beneath the Elementor Forms upload directory.

3. Review WordPress for unknown administrator accounts, unexpected plugins, recently modified PHP files, injected redirects and unauthorised pop-ups.
4. Where raw multipart inspection is available, consider a temporary WAF rule blocking duplicate file parts and PHP uploads to affected forms. Because the exact endpoint and field name are absent and the mechanism is single-sourced, test before enforcement.
5. Preserve web, PHP, WordPress, WAF/CDN, file-integrity and authentication telemetry for any affected host.

P3 — within seven days

1. Enforce non-executable upload directories across all WordPress properties rather than only the Elementor subdirectory.
2. Add file-integrity monitoring for new or modified PHP files beneath wp-content/uploads/.
3. Establish an inventory control requiring Elementor Pro 4.2.2 or later and alert on version regression.
4. Retrospectively review affected hosts for unauthorised accounts, plugins and code changes, including hosts patched without prior forensic review.
5. Re-test the exposed form workflow after upgrading and after applying web-server or WAF controls.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

The source provides no payload content suitable for malware-family detection. The following YARA rule is intended for captured HTTP data, web logs or forensic text exports containing the reported path; it is not a PHP-payload signature.

rule AT_CVE_2026_32475_Elementor_Forms_Uploaded_PHP_Path
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-20"
        reference = "https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html"
        description = "Detects a PHP path beneath the reported Elementor Forms upload directory"

    strings:
        $uploaded_php_path = /wp-content\/uploads\/elementor\/forms\/[^\/\r\n\t ]+\.php/ ascii

    condition:
        $uploaded_php_path
}

The following Sigma rule detects filesystem creation or modification telemetry for PHP files beneath the reported upload directory:

title: PHP File Written Beneath Elementor Forms Upload Directory
status: experimental
description: Detects a PHP file written beneath the Elementor Forms upload directory reported for CVE-2026-32475
author: Adverse Trace
date: 2026-08-20
references:

  - https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|contains: 'wp-content/uploads/elementor/forms/'
    TargetFilename|endswith: '.php'
  condition: selection
falsepositives:

  - No false-positive baseline is available in the supplied reporting; validate any authorised test files

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, “Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code,” 20 August 2026.
• NIST National Vulnerability Database, “CVE-2026-32475,” reference state supplied 20 August 2026.
• CISA, “Known Exploited Vulnerabilities Catalog,” reference state supplied 20 August 2026.

8. Adverse Trace position

Adverse Trace adopts the authoritative assessment of CVSS 9.0 CRITICAL; NOT in CISA KEV. Client impact is conditional on Elementor Pro 4.2.1 or earlier being deployed with a published Form widget containing a File Upload field, but that configuration is likely to be operationally common and should be remediated within 24 hours. The supplied material contains no confirmed exploitation, malicious payload or atomic IOC, and the detailed exploit mechanics are single-sourced; detection logic must be verified before enforcement. StopAndProtect is not linked to this vulnerability, and any actor attribution is unconfirmed. Adverse Trace will monitor for CISA KEV changes, corroborated exploitation, public exploit material and actionable indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.