Skip to navigation

Threat reportVulnerabilityTL-2026-2079

Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475)

criticalACTIVE

An unauthenticated arbitrary file upload vulnerability in Elementor Pro (CVE-2026-32475, CVSS 9.0) allows attackers to bypass extension validation and upload a malicious PHP payload to wp-content/uploads/elementor/forms/ via a crafted multipart request, achieving remote code execution on WordPress sites running Elementor Pro before version 4.2.2.

Key facts for Elementor Pro upload RCE

IdentifiersTL-2026-2079, CVE-2026-32475
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitation statusExploited in the wild
EPSSCVE-2026-32475: 1.9% (80.0th percentile)
Affected productsElementor Elementor Pro
Weaknesses (CWE)CWE-434
MalwarePHP webshell
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1036.005 Masquerading: Match Legitimate Name or Location, T1041 Exfiltration Over C2 Channel, T1057 Process Discovery, T1059 Command and Scripting Interpreter, T1070 Indicator Removal, T1071 Application Layer Protocol, T1071.001 Application Layer Protocol: Web Protocols, T1078 Valid Accounts, T1082 System Information Discovery, T1083 File and Directory Discovery and 14 more in the attack flow
MotivationUNKNOWN
Target sectorsecommerce, small-business, professional-services, media-and-publishing, education, health, government administration
Target regionsWorldwide
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Elementor Pro upload RCE

As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2079 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Elementor Pro Webshell Access — Suspicious PHP in Uploads Directory

Detects post-exploitation webshell access by monitoring for GET requests to .php files under wp-content/uploads/elementor/forms/. A successful CVE-2026-32475 exploit writes a PHP payload to this directory with a uniqid()-based filename (13 hex characters before the extension). This detection flags any PHP file access from the uploads directory — no legitimate PHP files should ever exist in a WordPress uploads path. Also detects the uniqid() hex filename pattern (lowercase hexadecimal, 13 chars before .php), which is highly specific to CVE-2026-32475 payloads.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1505.003, T1059.007, T1036.005
  • Data sources: apache_access_logs, nginx_access_logs, sysmon, windows_event_log_4688, process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

index=apache sourcetype=access_combined
  uri="/wp-content/uploads/elementor/forms/*.php"
  http_method=GET
  | rex field=uri "/(?<php_filename>[^/]+\.php)$"
  | eval is_uniqid_pattern=if(match(php_filename, "^[0-9a-f]{13}\.php$"), 1, 0)
  | eval threat_id="TL-2026-2079", alert_type="CVE-2026-32475-webshell-access"
  | stats count by _time, src_ip, uri, php_filename, is_uniqid_pattern, status, bytes, user_agent, threat_id, alert_type
  | sort - _time

Microsoft KQL

let Lookback = ago(24h);
(union isfuzzy=true
    DeviceFileEvents,
    DeviceProcessEvents
)
| where Timestamp > Lookback
// Detect PHP process execution originating from the WordPress uploads directory
| where InitiatingProcessFileName has_any ("php-cgi.exe", "php.exe", "php", "php-fpm")
| where InitiatingProcessCommandLine contains "elementor/forms"
| extend ThreatId = "TL-2026-2079"
| extend AlertType = "CVE-2026-32475-webshell-execution"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ThreatId, AlertType
| sort by Timestamp desc

Sigma

title: Suspicious PHP File Access in WordPress Uploads Directory — CVE-2026-32475 Webshell
description: Detects GET requests to PHP files under wp-content/uploads/elementor/forms/ indicating successful webshell upload and access through the CVE-2026-32475 exploit
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32475
    - https://attack.mitre.org/techniques/T1505.003/
    - https://attack.mitre.org/techniques/T1059.007/
tags:
    - attack.persistence
    - attack.t1505
    - attack.t1505.003
    - attack.execution
    - attack.t1059
    - attack.t1059.007
    - cve.2026.32475
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-pattern|startswith: '/wp-content/uploads/elementor/forms/'
        cs-uri-pattern|endswith: '.php'
    condition: selection
falsepositives:
    - Extremely rare: some misconfigured WordPress sites may store legitimate PHP files in uploads directory (investigate regardless)
    - Log parsing issues where a different request URI is incorrectly parsed
level: critical
priority: 1

Known false positives:

  • Extremely rare — some WordPress caching or security plugins may temporarily create .php files in uploads directories for testing; always investigate
  • Log entries where the request URI is truncated or malformed by the logging system

Tuning notes: This detection should produce near-zero false positives in a well-configured WordPress environment — no legitimate PHP files should exist in the uploads directory. If false positives occur, investigate the site's file structure immediately. The uniqid() filename pattern (13 lowercase hex chars + .php) is a strong secondary indicator of CVE-2026-32475 exploitation. Add file integrity monitoring (FIM) on the wp-content/uploads/ directory as a complementary detection.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Elementor Pro CVE-2026-32475 Exploitation — Web Application Firewall Detection · unlock with TL Creds
  • Elementor Pro Webshell Upload — Process Created from WordPress Uploads Directory · unlock with TL Creds
  • Elementor Pro Post-Exploitation — Web Server Lateral Movement and Reconnaissance · unlock with TL Creds
  • Elementor Pro CVE-2026-32475 Exploitation — Multipart Upload to admin-ajax.php · unlock with TL Creds
  • Elementor Pro Webshell Detection — PHP File in Uploads Directory · unlock with TL Creds
  • Elementor Pro Post-Exploitation — System Discovery via Web Shell · unlock with TL Creds
  • Elementor Pro File Upload Exploitation Attempt — Multipart Anomaly · unlock with TL Creds
  • Elementor Pro Post-Exploitation — Web Server Outbound C2 Connection · unlock with TL Creds

Indicators of compromise for Elementor Pro upload RCE

As of 2026-09-06, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-2079.

Sample indicators (3 of 25)

  • IP address: 185.196.220[.]85
  • IP address: 103.84.230[.]85
  • IP address: 103.90.148[.]202

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

25 indicators of compromise · unlock with TL Creds. Compare plans

How Elementor Pro upload RCE works

The flaw stems from a desynchronization between the validation() and process_field() loops in the Forms module's File Upload field — validation uses return while processing uses continue when encountering empty filename entries. Discovered by Patchstack researcher Tin Pham (TF1T). No active exploitation observed in the wild as of public disclosure, but the vulnerability is expected to be weaponized given Elementor's ~33% share of WordPress sites.

CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated arbitrary file upload vulnerability in Elementor Pro, the premium version of the most popular WordPress page builder plugin with over 5.8 million active installations. The flaw resides in the Forms module's File Upload field (modules/forms/fields/upload.php) and represents a textbook desynchronization bug between two code paths that process the same data with different rules.

The root cause is a mismatch between the validation() and process_field() methods when handling empty file entries (UPLOAD_ERR_NO_FILE). The validation loop uses PHP's return statement on encountering an empty entry, which exits the entire method immediately and skips all subsequent entries. The processing loop, however, uses continue, which merely skips the current iteration and proceeds to handle the next entry. This gap allows an attacker to submit a multipart upload containing two parts for the same form field: the first entry has a blank filename (triggering UPLOAD_ERR_NO_FILE), and the second entry contains a .php payload. The validation loop exits at the first entry, never inspecting the second; the processing loop skips the first and writes the second to the server.

The uploaded file lands in wp-content/uploads/elementor/forms/ uniqid>.php, a publicly accessible directory. PHP's uniqid() function is time-based — the first 8 hex digits encode the Unix epoch second (obtainable from the server's Date response header), and the remaining 5 hex digits encode microseconds, requiring only a narrow brute-force window. Alternatively, if the form's autoresponder email is enabled (a common configuration), the Elementor [all-fields] notification template includes the full uploaded file URL, requiring zero brute-force.

Exploitation prerequisites are minimal and extremely common on the web: the target site must have at least one published Elementor page containing a Form widget with a File Upload field. No authentication is required — the AJAX action elementor_pro_forms_send_form accepts unauthenticated submissions with no nonce or cookie validation. All required parameters (post_id, form_id, field names) are publicly visible in the page's HTML source. The 'Required' toggle on the file upload field defaults to off and does not need to be enabled.

Successful exploitation grants the attacker remote code execution at the web server privilege level, which can be used to deploy web shells, exfiltrate the WordPress database (including user credentials), install cryptominers, deface the site, distribute malware to visitors, pivot to internal networks, or create WordPress administrator accounts for persistent access. The Elementor Pro blocklist — which blocks php, php3-php7, phtml, shtml, pht, swf, html, asp, aspx, cmd, csh, bat, htm, hta, jar, exe, com, and others — is completely bypassed by the loop mismatch.

The fix was released in Elementor Pro version 4.2.2 on August 19, 2026, with two changes: (1) the validation loop was changed from return to continue, aligning the two loops' behavior on empty entries, and (2) an extension re-check was added inside process_field() itself immediately before the file move, providing defense-in-depth. However, updating alone does not remove webshells already uploaded during the exposure window — site owners must audit the uploads directory and scan for compromise signs.

The disclosure timeline involved a 34-day gap between patch preparation (July 17) and public release (August 19), during which Patchstack provided virtual patching to its customers. The CISA-ADP has analyzed the vulnerability via SSVC, assigning exploitation=none, automatable=no, and technical_impact=total. CVE-2026-32475 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Masquerading: Match Legitimate Name or Location; T1070 Indicator Removal

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1110 Brute Force

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Persistence

T1078 Valid Accounts; T1098 Account Manipulation; T1505 Server Software Component; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1496 Resource Hijacking; T1565 Data Manipulation

Resource Development

T1588.001 Obtain Capabilities: Malware; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1594 Search Victim-Owned Websites; T1595.002 Active Scanning: Vulnerability Scanning

Remediation for Elementor Pro upload RCE

Patches

  • Elementor Pro version 4.2.2 (released August 19, 2026) — contains fix aligning validation and processing loops and adds extension re-check before file move

Immediate actions

  • Update Elementor Pro to version 4.2.2 or later immediately
  • Audit wp-content/uploads/elementor/forms/ for any .php, .phtml, or other unexpected executable files
  • Run find wp-content/uploads/elementor/forms/ -name '*.php' to detect potential webshells
  • Scan server for unauthorized WordPress admin accounts and plugin modifications
  • Review web server access logs for POST requests to admin-ajax.php with action=elementor_pro_forms_send_form followed by GET requests to files in wp-content/uploads/elementor/forms/
  • Check for signs of cryptominer processes, unauthorized SSH keys, or unexpected cron jobs

Workarounds

  • If unable to update immediately, deploy WAF rules blocking multipart POST requests to elementor_pro_forms_send_form with multiple file entries for a single field
  • Patchstack customers have virtual patching mitigation rules available from July 16
  • Disable the File Upload field on all Elementor forms until the patch can be applied
  • Configure Patchstack or a similar WordPress security plugin to enforce virtual patching

Longer-term hardening

  • Disable PHP execution in wp-content/uploads/ via .htaccess (Apache: 'Require all denied') or nginx config ('deny all;')
  • Implement Web Application Firewall (WAF) rules to detect multipart upload anomalies
  • Enable automatic plugin updates for critical WordPress plugins
  • Adopt a least-privilege file system model — store uploads outside the web root and serve through access-controlled scripts
  • Implement file integrity monitoring (FIM) for wp-content/uploads/ directory
  • Regularly audit installed plugins and remove unused ones

Affected and fixed versions

  • Elementor — Elementor Pro
    Vulnerable versions: ≤ 4.2.1
    Fixed in: 4.2.2

Timeline of Elementor Pro upload RCE

Last updated · 3 updates · revalidated 3× · latest source

Showing the 20 most recent tracked events.

  • Patchstack sends early warning to Patchstack customers with virtual patching mitigation rules
  • Researcher Tin Pham (TF1T) reports the vulnerability to Patchstack; Patchstack confirms the flaw, contacts the Elementor vendor, and assigns CVE-2026-32475 as a CNA
  • Elementor prepares a security patch for the vulnerability, beginning the 34-day window before public release
  • Austin Ginder (Anchor Hosting) independently discovers the same vulnerability and reports it to Wordfence's bug bounty program, eight days after Tin Pham's initial report to Patchstack.
  • Patchstack reviews the vendor's patch and confirms it correctly resolves the desynchronization flaw
  • Mass automated exploitation of CVE-2026-32475 begins the same day Elementor Pro 4.2.2 and the Patchstack advisory go public, consistent with weaponizing the patch diff/advisory.
  • CISA-ADP adds SSVC decision point analysis to CVE-2026-32475: exploitation=none, automatable=no, technical_impact=total
  • Patchstack publishes full public security advisory detailing CVE-2026-32475 with PHP code snippets showing the validation vs. processing loop desynchronization
  • Elementor releases Elementor Pro version 4.2.2 with the security fix, described in changelog as 'Improved code security enforcement in Form widget' and Dynamic Tags
  • Vulnerability expected to be weaponized in automated mass-exploit campaigns given Elementor's dominant market share (32.67% of WordPress sites, 5.8M+ Pro active installs) and the fully public technical exploitation mechanism
  • BleepingComputer, The Hacker News, and Cyber Kendra publish articles on the vulnerability, urging WordPress site owners to update Elementor Pro to version 4.2.2
  • NVD publishes CVE-2026-32475 record with CVSS 9.0 (Critical), CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-434
  • Cybersecurity News publishes analysis estimating 3+ million WordPress sites at risk from CVE-2026-32475, widening prior scale estimates.
  • Wordfence observes the peak of a heightened attack-activity window running 2026-08-19 through 2026-08-23.
  • MagicWP publishes a deep technical analysis of the flaw, noting that although no public PoC existed yet at that time, the advisory detail already made the practical barrier to writing an exploit low.
  • Wordfence/Defiant reports its WAF has blocked more than 190,000 exploitation attempts targeting the flaw and publishes attacking IP addresses for blocklisting.
  • Researcher Boreas37 publishes a working proof-of-concept exploit on GitHub (Boreas37/CVE-2026-32475-PoC) automating the full attack chain, including uniqid() filename brute-force recovery.
  • Roughly two-thirds of the ~10 million total Elementor installations remain on unpatched versions, per reported adoption tracking.
  • The Hacker News reports over 440,000 cumulative exploit attempts targeting Elementor Pro (and the related Super Forms plugin) for CVE-2026-32475, up from the ~190,000 attempts Wordfence reported on 2026-09-02.
  • SecurityWeek and other outlets publish coverage of the ongoing mass exploitation campaign.

Update history

Sources cited for Elementor Pro upload RCE

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats