Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475)

Critical Elementor Pro unauthenticated file upload (TL-2026-2079) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-20 and last reviewed 2026-09-06. It has no confirmed attribution, affects Elementor Elementor Pro, references 1 CVE (CVE-2026-32475), maps to 26 MITRE ATT&CK techniques (T1027, T1036, T1036.005), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-2079

Threat ID
TL-2026-2079
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-20
Last reviewed
2026-09-06
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
ecommerce, small-business, professional-services, media-and-publishing, education, health, government administration
Target regions
Worldwide
Detection rules
9
Indicators of compromise
25
Updates
2026-09-06 · 3 updates · revalidated 3× · latest source

Malware and tooling in Critical Elementor Pro unauthenticated file upload

Malware and tooling: PHP webshell

An unauthenticated arbitrary file upload vulnerability in Elementor Pro (CVE-2026-32475, CVSS 9.0) allows attackers to bypass extension validation and upload a malicious PHP payload to wp-content/uploads/elementor/forms/ via a crafted multipart request, achieving remote code execution on WordPress sites running Elementor Pro before version 4.2.2. The flaw stems from a desynchronization between the validation() and process_field() loops in the Forms module's File Upload field — validation uses return while processing uses continue when encountering empty filename entries. Discovered by Patchstack researcher Tin Pham (TF1T). No active exploitation observed in the wild as of public disclosure, but the vulnerability is expected to be weaponized given Elementor's ~33% share of WordPress sites.

How Critical Elementor Pro unauthenticated file upload works

CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated arbitrary file upload vulnerability in Elementor Pro, the premium version of the most popular WordPress page builder plugin with over 5.8 million active installations. The flaw resides in the Forms module's File Upload field (modules/forms/fields/upload.php) and represents a textbook desynchronization bug between two code paths that process the same data with different rules.

The root cause is a mismatch between the validation() and process_field() methods when handling empty file entries (UPLOAD_ERR_NO_FILE). The validation loop uses PHP's return statement on encountering an empty entry, which exits the entire method immediately and skips all subsequent entries. The processing loop, however, uses continue, which merely skips the current iteration and proceeds to handle the next entry. This gap allows an attacker to submit a multipart upload containing two parts for the same form field: the first entry has a blank filename (triggering UPLOAD_ERR_NO_FILE), and the second entry contains a .php payload. The validation loop exits at the first entry, never inspecting the second; the processing loop skips the first and writes the second to the server.

The uploaded file lands in wp-content/uploads/elementor/forms/ uniqid>.php, a publicly accessible directory. PHP's uniqid() function is time-based — the first 8 hex digits encode the Unix epoch second (obtainable from the server's Date response header), and the remaining 5 hex digits encode microseconds, requiring only a narrow brute-force window. Alternatively, if the form's autoresponder email is enabled (a common configuration), the Elementor [all-fields] notification template includes the full uploaded file URL, requiring zero brute-force.

Exploitation prerequisites are minimal and extremely common on the web: the target site must have at least one published Elementor page containing a Form widget with a File Upload field. No authentication is required — the AJAX action elementor_pro_forms_send_form accepts unauthenticated submissions with no nonce or cookie validation. All required parameters (post_id, form_id, field names) are publicly visible in the page's HTML source. The 'Required' toggle on the file upload field defaults to off and does not need to be enabled.

Successful exploitation grants the attacker remote code execution at the web server privilege level, which can be used to deploy web shells, exfiltrate the WordPress database (including user credentials), install cryptominers, deface the site, distribute malware to visitors, pivot to internal networks, or create WordPress administrator accounts for persistent access. The Elementor Pro blocklist — which blocks php, php3-php7, phtml, shtml, pht, swf, html, asp, aspx, cmd, csh, bat, htm, hta, jar, exe, com, and others — is completely bypassed by the loop mismatch.

The fix was released in Elementor Pro version 4.2.2 on August 19, 2026, with two changes: (1) the validation loop was changed from return to continue, aligning the two loops' behavior on empty entries, and (2) an extension re-check was added inside process_field() itself immediately before the file move, providing defense-in-depth. However, updating alone does not remove webshells already uploaded during the exposure window — site owners must audit the uploads directory and scan for compromise signs.

The disclosure timeline involved a 34-day gap between patch preparation (July 17) and public release (August 19), during which Patchstack provided virtual patching to its customers. The CISA-ADP has analyzed the vulnerability via SSVC, assigning exploitation=none, automatable=no, and technical_impact=total. CVE-2026-32475 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.

MITRE ATT&CK techniques used in TL-2026-2079

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Masquerading: Match Legitimate Name or Location; T1070 Indicator Removal

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1110 Brute Force

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Persistence

T1078 Valid Accounts; T1098 Account Manipulation; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1496 Resource Hijacking; T1565 Data Manipulation

Resource Development

T1588.001 Obtain Capabilities: Malware; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1594 Search Victim-Owned Websites; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Critical Elementor Pro unauthenticated file upload

  • Elementor — Elementor Pro
    Vulnerable versions: ≤ 4.2.1
    Fixed in: 4.2.2

Remediation for Critical Elementor Pro unauthenticated file upload

Patches

  • Elementor Pro version 4.2.2 (released August 19, 2026) — contains fix aligning validation and processing loops and adds extension re-check before file move

Immediate actions

  • Update Elementor Pro to version 4.2.2 or later immediately
  • Audit wp-content/uploads/elementor/forms/ for any .php, .phtml, or other unexpected executable files
  • Run find wp-content/uploads/elementor/forms/ -name '*.php' to detect potential webshells
  • Scan server for unauthorized WordPress admin accounts and plugin modifications
  • Review web server access logs for POST requests to admin-ajax.php with action=elementor_pro_forms_send_form followed by GET requests to files in wp-content/uploads/elementor/forms/
  • Check for signs of cryptominer processes, unauthorized SSH keys, or unexpected cron jobs

Workarounds

  • If unable to update immediately, deploy WAF rules blocking multipart POST requests to elementor_pro_forms_send_form with multiple file entries for a single field
  • Patchstack customers have virtual patching mitigation rules available from July 16
  • Disable the File Upload field on all Elementor forms until the patch can be applied
  • Configure Patchstack or a similar WordPress security plugin to enforce virtual patching

Longer-term hardening

  • Disable PHP execution in wp-content/uploads/ via .htaccess (Apache: 'Require all denied') or nginx config ('deny all;')
  • Implement Web Application Firewall (WAF) rules to detect multipart upload anomalies
  • Enable automatic plugin updates for critical WordPress plugins
  • Adopt a least-privilege file system model — store uploads outside the web root and serve through access-controlled scripts
  • Implement file integrity monitoring (FIM) for wp-content/uploads/ directory
  • Regularly audit installed plugins and remove unused ones

CVEs associated with Critical Elementor Pro unauthenticated file upload

CVE-2026-32475

Weaknesses (CWE) in Critical Elementor Pro unauthenticated file upload

CWE-434

Timeline of Critical Elementor Pro unauthenticated file upload

Showing the 20 most recent tracked events.

  • Patchstack sends early warning to Patchstack customers with virtual patching mitigation rules
  • Researcher Tin Pham (TF1T) reports the vulnerability to Patchstack; Patchstack confirms the flaw, contacts the Elementor vendor, and assigns CVE-2026-32475 as a CNA
  • Elementor prepares a security patch for the vulnerability, beginning the 34-day window before public release
  • Austin Ginder (Anchor Hosting) independently discovers the same vulnerability and reports it to Wordfence's bug bounty program, eight days after Tin Pham's initial report to Patchstack.
  • Patchstack reviews the vendor's patch and confirms it correctly resolves the desynchronization flaw
  • Mass automated exploitation of CVE-2026-32475 begins the same day Elementor Pro 4.2.2 and the Patchstack advisory go public, consistent with weaponizing the patch diff/advisory.
  • CISA-ADP adds SSVC decision point analysis to CVE-2026-32475: exploitation=none, automatable=no, technical_impact=total
  • Patchstack publishes full public security advisory detailing CVE-2026-32475 with PHP code snippets showing the validation vs. processing loop desynchronization
  • Elementor releases Elementor Pro version 4.2.2 with the security fix, described in changelog as 'Improved code security enforcement in Form widget' and Dynamic Tags
  • Vulnerability expected to be weaponized in automated mass-exploit campaigns given Elementor's dominant market share (32.67% of WordPress sites, 5.8M+ Pro active installs) and the fully public technical exploitation mechanism
  • BleepingComputer, The Hacker News, and Cyber Kendra publish articles on the vulnerability, urging WordPress site owners to update Elementor Pro to version 4.2.2
  • NVD publishes CVE-2026-32475 record with CVSS 9.0 (Critical), CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-434
  • Cybersecurity News publishes analysis estimating 3+ million WordPress sites at risk from CVE-2026-32475, widening prior scale estimates.
  • Wordfence observes the peak of a heightened attack-activity window running 2026-08-19 through 2026-08-23.
  • MagicWP publishes a deep technical analysis of the flaw, noting that although no public PoC existed yet at that time, the advisory detail already made the practical barrier to writing an exploit low.
  • Wordfence/Defiant reports its WAF has blocked more than 190,000 exploitation attempts targeting the flaw and publishes attacking IP addresses for blocklisting.
  • Researcher Boreas37 publishes a working proof-of-concept exploit on GitHub (Boreas37/CVE-2026-32475-PoC) automating the full attack chain, including uniqid() filename brute-force recovery.
  • Roughly two-thirds of the ~10 million total Elementor installations remain on unpatched versions, per reported adoption tracking.
  • The Hacker News reports over 440,000 cumulative exploit attempts targeting Elementor Pro (and the related Super Forms plugin) for CVE-2026-32475, up from the ~190,000 attempts Wordfence reported on 2026-09-02.
  • SecurityWeek and other outlets publish coverage of the ongoing mass exploitation campaign.

Update history for TL-2026-2079

Sources cited for Critical Elementor Pro unauthenticated file upload

More in vulnerability

Detection coverage for TL-2026-2079

As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2079 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats