# Critical Elementor Pro unauthenticated file upload vulnerability leads to RCE on WordPress sites (CVE-2026-32475)

> An unauthenticated arbitrary file upload vulnerability in Elementor Pro (CVE-2026-32475, CVSS 9.0) allows attackers to bypass extension validation and upload a malicious PHP payload to wp-content/uploads/elementor/forms/ via a crafted multipart request, achieving remote code execution on WordPress sites running Elementor Pro before version 4.2.2. The flaw stems from a desynchronization between the validation() and process_field() loops in the Forms module's File Upload field — validation uses return while processing uses continue when encountering empty filename entries. Discovered by Patchstack researcher Tin Pham (TF1T). No active exploitation observed in the wild as of public disclosure, but the vulnerability is expected to be weaponized given Elementor's ~33% share of WordPress sites.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-09-06T14:07:12.628Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2079
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-elementor-pro-upload-rce-tl-2026-2079.webp?v=d8488280 (Threadlinqs threat intel: CVE-2026-32475 Elementor Pro Upload RCE: Detection & IOCs (TL-2026-2079) — Critical severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-2079
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)
- **CVEs:** CVE-2026-32475

## Description

CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated arbitrary file upload vulnerability in Elementor Pro, the premium version of the most popular WordPress page builder plugin with over 5.8 million active installations. The flaw resides in the Forms module's File Upload field (modules/forms/fields/upload.php) and represents a textbook desynchronization bug between two code paths that process the same data with different rules.

The root cause is a mismatch between the validation() and process_field() methods when handling empty file entries (UPLOAD_ERR_NO_FILE). The validation loop uses PHP's return statement on encountering an empty entry, which exits the entire method immediately and skips all subsequent entries. The processing loop, however, uses continue, which merely skips the current iteration and proceeds to handle the next entry. This gap allows an attacker to submit a multipart upload containing two parts for the same form field: the first entry has a blank filename (triggering UPLOAD_ERR_NO_FILE), and the second entry contains a .php payload. The validation loop exits at the first entry, never inspecting the second; the processing loop skips the first and writes the second to the server.

The uploaded file lands in wp-content/uploads/elementor/forms/
uniqid>.php, a publicly accessible directory. PHP's uniqid() function is time-based — the first 8 hex digits encode the Unix epoch second (obtainable from the server's Date response header), and the remaining 5 hex digits encode microseconds, requiring only a narrow brute-force window. Alternatively, if the form's autoresponder email is enabled (a common configuration), the Elementor [all-fields] notification template includes the full uploaded file URL, requiring zero brute-force.

Exploitation prerequisites are minimal and extremely common on the web: the target site must have at least one published Elementor page containing a Form widget with a File Upload field. No authentication is required — the AJAX action elementor_pro_forms_send_form accepts unauthenticated submissions with no nonce or cookie validation. All required parameters (post_id, form_id, field names) are publicly visible in the page's HTML source. The 'Required' toggle on the file upload field defaults to off and does not need to be enabled.

Successful exploitation grants the attacker remote code execution at the web server privilege level, which can be used to deploy web shells, exfiltrate the WordPress database (including user credentials), install cryptominers, deface the site, distribute malware to visitors, pivot to internal networks, or create WordPress administrator accounts for persistent access. The Elementor Pro blocklist — which blocks php, php3-php7, phtml, shtml, pht, swf, html, asp, aspx, cmd, csh, bat, htm, hta, jar, exe, com, and others — is completely bypassed by the loop mismatch.

The fix was released in Elementor Pro version 4.2.2 on August 19, 2026, with two changes: (1) the validation loop was changed from return to continue, aligning the two loops' behavior on empty entries, and (2) an extension re-check was added inside process_field() itself immediately before the file move, providing defense-in-depth. However, updating alone does not remove webshells already uploaded during the exposure window — site owners must audit the uploads directory and scan for compromise signs.

The disclosure timeline involved a 34-day gap between patch preparation (July 17) and public release (August 19), during which Patchstack provided virtual patching to its customers. The CISA-ADP has analyzed the vulnerability via SSVC, assigning exploitation=none, automatable=no, and technical_impact=total. CVE-2026-32475 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1036 Masquerading
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071 Application Layer Protocol
- T1496 Resource Hijacking
- T1485 Data Destruction
- T1565 Data Manipulation
- T1027 Obfuscated Files or Information
- T1083 File and Directory Discovery
- T1110 Brute Force
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1595.002 Active Scanning: Vulnerability Scanning
- T1594 Search Victim-Owned Websites
- T1588.005 Obtain Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1588.001 Obtain Capabilities: Malware
- T1505.003 Server Software Component: Web Shell
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1071.001 Application Layer Protocol: Web Protocols
- T1070 Indicator Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Elementor Pro Webshell Access — Suspicious PHP in Uploads Directory** (`TL-2026-2079-SPL-002`)

Detects post-exploitation webshell access by monitoring for GET requests to .php files under wp-content/uploads/elementor/forms/. A successful CVE-2026-32475 exploit writes a PHP payload to this directory with a uniqid()-based filename (13 hex characters before the extension). This detection flags any PHP file access from the uploads directory — no legitimate PHP files should ever exist in a WordPress uploads path. Also detects the uniqid() hex filename pattern (lowercase hexadecimal, 13 chars before .php), which is highly specific to CVE-2026-32475 payloads.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1059.007, T1036.005
- **Data sources:** apache_access_logs, nginx_access_logs, sysmon, windows_event_log_4688, process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=apache sourcetype=access_combined
  uri="/wp-content/uploads/elementor/forms/*.php"
  http_method=GET
  | rex field=uri "/(?<php_filename>[^/]+\.php)$"
  | eval is_uniqid_pattern=if(match(php_filename, "^[0-9a-f]{13}\.php$"), 1, 0)
  | eval threat_id="TL-2026-2079", alert_type="CVE-2026-32475-webshell-access"
  | stats count by _time, src_ip, uri, php_filename, is_uniqid_pattern, status, bytes, user_agent, threat_id, alert_type
  | sort - _time
```

### Microsoft KQL

```kql
let Lookback = ago(24h);
(union isfuzzy=true
    DeviceFileEvents,
    DeviceProcessEvents
)
| where Timestamp > Lookback
// Detect PHP process execution originating from the WordPress uploads directory
| where InitiatingProcessFileName has_any ("php-cgi.exe", "php.exe", "php", "php-fpm")
| where InitiatingProcessCommandLine contains "elementor/forms"
| extend ThreatId = "TL-2026-2079"
| extend AlertType = "CVE-2026-32475-webshell-execution"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ThreatId, AlertType
| sort by Timestamp desc
```

### Sigma

```yaml
title: Suspicious PHP File Access in WordPress Uploads Directory — CVE-2026-32475 Webshell
description: Detects GET requests to PHP files under wp-content/uploads/elementor/forms/ indicating successful webshell upload and access through the CVE-2026-32475 exploit
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32475
    - https://attack.mitre.org/techniques/T1505.003/
    - https://attack.mitre.org/techniques/T1059.007/
tags:
    - attack.persistence
    - attack.t1505
    - attack.t1505.003
    - attack.execution
    - attack.t1059
    - attack.t1059.007
    - cve.2026.32475
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-pattern|startswith: '/wp-content/uploads/elementor/forms/'
        cs-uri-pattern|endswith: '.php'
    condition: selection
falsepositives:
    - Extremely rare: some misconfigured WordPress sites may store legitimate PHP files in uploads directory (investigate regardless)
    - Log parsing issues where a different request URI is incorrectly parsed
level: critical
priority: 1
```

**Known false positives:**

- Extremely rare — some WordPress caching or security plugins may temporarily create .php files in uploads directories for testing; always investigate
- Log entries where the request URI is truncated or malformed by the logging system

**Tuning notes:** This detection should produce near-zero false positives in a well-configured WordPress environment — no legitimate PHP files should exist in the uploads directory. If false positives occur, investigate the site's file structure immediately. The uniqid() filename pattern (13 lowercase hex chars + .php) is a strong secondary indicator of CVE-2026-32475 exploitation. Add file integrity monitoring (FIM) on the wp-content/uploads/ directory as a complementary detection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Elementor Pro CVE-2026-32475 Exploitation — Web Application Firewall Detection (locked: unlock with TL Creds)
- Elementor Pro Webshell Upload — Process Created from WordPress Uploads Directory (locked: unlock with TL Creds)
- Elementor Pro Post-Exploitation — Web Server Lateral Movement and Reconnaissance (locked: unlock with TL Creds)
- Elementor Pro CVE-2026-32475 Exploitation — Multipart Upload to admin-ajax.php (locked: unlock with TL Creds)
- Elementor Pro Webshell Detection — PHP File in Uploads Directory (locked: unlock with TL Creds)
- Elementor Pro Post-Exploitation — System Discovery via Web Shell (locked: unlock with TL Creds)
- Elementor Pro File Upload Exploitation Attempt — Multipart Anomaly (locked: unlock with TL Creds)
- Elementor Pro Post-Exploitation — Web Server Outbound C2 Connection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `185.196.220[.]85`
- IP address: `103.84.230[.]85`
- IP address: `103.90.148[.]202`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Critical Elementor Pro bug exposes WordPress sites to RCE attacks](https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/)
- [Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin](https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/)
- [WordPress Elementor Pro Plugin 4.2.1 Arbitrary File Upload Vulnerability](https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability)
- [NVD - CVE-2026-32475](https://nvd.nist.gov/vuln/detail/CVE-2026-32475)
- [Elementor Pro Flaw Could Let Attackers Execute Code on WordPress Sites](https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html)
- [Elementor Pro RCE Flaw CVE-2026-32475](https://www.cyberkendra.com/2026/08/elementor-pro-rce-flaw-cve-2026-32475.html)
- [Elementor Pro Changelog - Version 4.2.2](https://elementor.com/pro/changelog/)
- [CVE-2026-32475 at MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32475)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2079