Security researchers have uncovered a critical security flaw in the Elementor Pro WordPress plugin that could allow hackers to remotely execute code on vulnerable websites. The vulnerability, identified as CVE-2026-32475 and disclosed by Patchstack, carries a severity score of 9.0 out of 10.0. The bug represents a significant threat to WordPress sites using one of the platform's most popular page-building tools.
The security defect stems from the Forms module's File Upload field, where validation of file extensions and the file transfer process occur in separate loops with inconsistent handling of blank file entries. By uploading two file components for the same input field, an attacker without any login credentials can bypass the extension blocklist completely and place a PHP file into a publicly accessible directory. Every version of the plugin through 4.2.1 is affected by the issue. The only requirement for a successful attack is that the target website has at least one live Elementor page with a Form widget containing a File Upload field—which Patchstack describes as "an extremely common, everyday configuration." The malicious file lands in the directory "wp-content/uploads/elementor/forms/
Security researcher Tin Pham, working under the alias TF1T, discovered and reported the vulnerability through the Patchstack Bug Bounty Program. According to the report, the inconsistency between how the plugin checks file extensions and relocates uploaded files when processing empty entries transforms what should be a restricted upload feature into an unauthenticated remote code execution vulnerability. The report notes that the File Upload field's default configuration leaves the 'Required' toggle switched off, meaning "no hardened or unusual setting is needed" for a site to be vulnerable. Patchstack emphasizes that job-application forms, photo or document submission forms, and support-ticket attachment systems all commonly use this configuration.
The flaw works because successful exploitation lets an attacker upload arbitrary files, including PHP scripts, which can then be executed to take control of affected systems. After Elementor Pro received the disclosure on July 16, 2026, the company released a patched version 4.2.2 on August 19. The timing coincides with WordPress core's own security update—version 7.0.4 addressed a separate high-severity remote code execution bug (CVE-2026-65640, scoring 8.8) that allows Author-level users or higher to upload malicious Postscript files when Imagick and Ghostscript are running on the server. That vulnerability affects WordPress core versions from 4.7 through 7.0. The report also highlights the discovery of a large-scale campaign called StopAndProtect that's converting thousands of compromised WordPress sites into a distributed network for malware distribution, command-and-control operations, and stolen data storage.
WordPress site owners should immediately update their installations and plugins to the latest versions, according to the report's recommendations. The report advises scanning for unauthorized changes that trigger unexpected redirects or pop-ups, and conducting audits to identify unknown user accounts and plugins. The converging threats—both plugin-level vulnerabilities and core platform weaknesses—underscore the importance of treating routine file-upload features as potential attack vectors requiring rigorous security oversight. The dual nature of risk exposure calls for organisations to recalibrate their threat models around seemingly mundane user-facing features. Whether it's a contributor portal or a customer support form, the presumption of safety around basic upload functionality may no longer align with the sophistication of current exploit techniques.