Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475) — Threadlinqs Intelligence
As of 2026-09-05, Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-2079 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-09-05 · 2 updates · revalidated 2× · latest source
An unauthenticated arbitrary file upload vulnerability in Elementor Pro (CVE-2026-32475, CVSS 9.0) allows attackers to bypass extension validation and upload a malicious PHP payload to
CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated arbitrary file upload vulnerability in Elementor Pro, the premium version of the most popular WordPress page builder plugin with over 5.8 million active installations. The flaw resides in the Forms module's File Upload field (modules/forms/fields/upload.php) and represents a textbook desynchronization bug between two code paths that process the same data with different rules.
The root cause is a mismatch between the validation() and process_field() methods when handling empty file entries (UPLOAD_ERR_NO_FILE). The validation loop uses PHP's return statement on encountering an empty entry, which exits the entire method immediately and skips all subsequent entries. The processing loop, however, uses continue, which merely skips the current iteration and proceeds to handle the next entry. This gap allows an attacker to submit a multipart upload containing two parts for the same form field: the first entry has a blank filename (triggering UPLOAD_ERR_NO_FILE), and the second entry contains a .php payload. The validation loop exits at the first entry, never inspecting the second; the processing loop skips the first and writes the second to the server.
The uploaded file lands in wp-content/uploads/elementor/forms/
uniqid>.php, a publicly accessible directory. PHP's uniqid() function is time-based — the first 8 hex digits encode the Unix epoch second (obtainable from the server's Date response header), and the remaining 5 hex digits encode microseconds, requiring only a narrow brute-force window. Alternatively, if the form's autoresponder email is enabled (a common configuration), the Elementor [all-fields] notification template includes the full uploaded file URL, requiring zero brute-force.
Exploitation prerequisites are minimal and extremely common on the web: the target site must have at least one published Elementor page containing a Form widget with a File Upload field. No authentication is required — the AJAX action elementor_pro_forms_send_form accepts unauthenticated submissions with no nonce or cookie validation. All required parameters (post_id, form_id, field names) are publicly visible in the page's HTML source. The 'Required' toggle on the file upload field defaults to off and does not need to be enabled.
Successful exploitation grants the attacker remote code execution at the web server privilege level, which can be used to deploy web shells, exfiltrate the WordPress database (including user credentials), install cryptominers, deface the site, distribute malware to visitors, pivot to internal networks, or create WordPress administrator accounts for persistent access. The Elementor Pro blocklist — which blocks php, php3-php7, phtml, shtml, pht, swf, html, asp, aspx, cmd, csh, bat, htm, hta, jar, exe, com, and others — is completely bypassed by the loop mismatch.
The fix was released in Elementor Pro version 4.2.2 on August 19, 2026, with two changes: (1) the validation loop was changed from return to continue, aligning the two loops' behavior on empty entries, and (2) an extension re-check was added inside process_field() itself immediately before the file move, providing defense-in-depth. However, updating alone does not remove webshells already uploaded during the exposure window — site owners must audit the uploads directory and scan for compromise signs.
The disclosure timeline involved a 34-day gap between patch preparation (July 17) and public release (August 19), during which Patchstack provided virtual patching to its customers. The CISA-ADP has analyzed the vulnerability via SSVC, assigning exploitation=none, automatable=no, and technical_impact=total. CVE-2026-32475 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.
Target sectors: ecommerce, small-business, professional-services, media-and-publishing, education, health, government administration
Target regions: Worldwide
Timeline
- Researcher Tin Pham (TF1T) reports the vulnerability to Patchstack; Patchstack confirms the flaw, contacts the Elementor vendor, and assigns CVE-2026-32475 as a CNA
- Patchstack sends early warning to Patchstack customers with virtual patching mitigation rules
- Elementor prepares a security patch for the vulnerability, beginning the 34-day window before public release
- Patchstack reviews the vendor's patch and confirms it correctly resolves the desynchronization flaw
- Elementor releases Elementor Pro version 4.2.2 with the security fix, described in changelog as 'Improved code security enforcement in Form widget' and Dynamic Tags
- Patchstack publishes full public security advisory detailing CVE-2026-32475 with PHP code snippets showing the validation vs. processing loop desynchronization
- CISA-ADP adds SSVC decision point analysis to CVE-2026-32475: exploitation=none, automatable=no, technical_impact=total
- Mass automated exploitation of CVE-2026-32475 begins the same day Elementor Pro 4.2.2 and the Patchstack advisory go public, consistent with weaponizing the patch diff/advisory.
- NVD publishes CVE-2026-32475 record with CVSS 9.0 (Critical), CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-434
- BleepingComputer, The Hacker News, and Cyber Kendra publish articles on the vulnerability, urging WordPress site owners to update Elementor Pro to version 4.2.2
- Vulnerability expected to be weaponized in automated mass-exploit campaigns given Elementor's dominant market share (32.67% of WordPress sites, 5.8M+ Pro active installs) and the fully public technical exploitation mechanism
- Cybersecurity News publishes analysis estimating 3+ million WordPress sites at risk from CVE-2026-32475, widening prior scale estimates.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-32475, T1190, T1059, T1505, T1078, T1098, T1036, T1082, T1057, T1071, T1496
