Critical Unauthenticated File Upload Flaw in Elementor Pro Allows Remote Code Execution on WordPress Sites

A critical vulnerability identified as CVE-2026-32475 has been found in the Elementor Pro plugin for WordPress, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on affected sites.

The issue affects all versions prior to 4.2.2 and stems from inconsistent handling of empty filenames between the validation and file-saving routines in the upload module. Researchers at Patchstack determined that an attacker can craft a multipart request where the first part contains a file with no name and the second part delivers a PHP backdoor.

Because the validation loop fails on the empty entry and aborts early, the malicious payload reaches the upload handler, which saves it to the publicly writable directory wp-content/uploads/elementor/forms/. The attacker can then guess the filename based on creation timestamps or obtain the exact path through autoresponder emails in certain configurations.

Successful exploitation requires a published Elementor Pro form that includes a file-upload field with the multiple-file attachment option enabled; this setting is disabled by default. The free version of Elementor, which has more than 10 million installations, is not impacted.

Developers addressed the flaw in Elementor Pro 4.2.2. Site owners should apply the update without delay and inspect the upload directory for unexpected PHP files or other anomalies. The patch does not remove any previously planted backdoors. No active attacks have been recorded so far, but publication of technical details is expected to prompt exploitation attempts.