Critical Unauthenticated File Upload to RCE in Elementor Pro WordPress Plugin

A critical unauthenticated arbitrary file upload vulnerability, identified as CVE-2026-32475, has been discovered in popular WordPress plugin Elementor Pro, affecting versions 4.2.1 and below. The flaw resides within the Forms module's File Upload field, where a specific mishandling of empty file entries during processing allows attackers to bypass security checks.

This vulnerability stems from a logic error in how the plugin processes uploaded files. The validation and file-moving steps operate in separate loops, and crucially, they treat empty file entries differently. By submitting a specially crafted multi-part request containing two file parts for the same field, an unauthenticated attacker can trick the plugin. The first empty file part causes the validation loop to exit prematurely, effectively skipping the extension checks for subsequent file parts.

Once the extension checks are bypassed, the second loop, responsible for moving the uploaded file, proceeds without proper scrutiny. This allows an attacker to upload a malicious PHP file, which is then saved into a public directory on the affected WordPress site. The file is given a unique name generated by PHP's uniqid() function, but importantly, it retains the attacker-controlled malicious extension.

The impact of this vulnerability is severe, enabling remote code execution (RCE) on compromised websites. With an uploaded PHP file in a public directory, an attacker can execute arbitrary code on the server, potentially leading to full website compromise, data theft, or further malicious activities. The CVSS score for this vulnerability is rated at 9.0, highlighting its critical nature.

Elementor Pro is a widely used premium extension for the Elementor page builder, adding features like a Forms widget that includes a File Upload field. This makes the potential attack surface significant, as many WordPress sites utilize this functionality to allow visitors to submit documents or other files.

Patchstack, a security firm specializing in web application vulnerabilities, has issued mitigation rules to protect against exploitation of this flaw. Users of Elementor Pro are strongly advised to update to a patched version as soon as possible to prevent potential attacks. The vulnerability was discovered and reported by security researcher Tin Pham, also known as TF1T.

This incident underscores the ongoing security challenges faced by popular WordPress plugins. Developers must implement robust validation and processing logic to prevent such bypasses, especially when dealing with file uploads. The interaction between different processing stages can create complex attack vectors if not carefully managed, as demonstrated by this specific flaw in Elementor Pro.