Critical Elementor Pro Flaw Lets Attackers Run Code on WordPress Sites
A critical vulnerability in the Elementor Pro WordPress plugin exposes millions of websites to remote code execution attacks. The flaw, tracked as CVE-2026-32475, affects all versions of Elementor Pro before 4.2.2 and stems from the plugin's File Upload module. Researchers at Patchstack, a cybersecurity company focused on the WordPress ecosystem, discover that the validation and processing loops in the module handle empty filename uploads differently, creating a dangerous inconsistency attackers can exploit.
By crafting a multipart upload with an empty filename in the first entry followed by a malicious PHP payload, an attacker tricks the validation routine into exiting early while the processing loop still moves the malicious file into a public directory. Exploitation requires only that a target site publish an Elementor form containing a File Upload field. The uploaded file lands in wp-content/uploads/elementor/forms/, and because its filename comes from PHP's time-based uniqid() function rather than a truly random generator, attackers can determine the payload's name through timing brute-force or, in some configurations, through an autoresponder email.
Elementor Pro is the paid version of one of the most popular WordPress page builders, with the free version powering more than 10 million active installs. The Pro tier adds advanced features like form creation, popup builders, custom code, and e-commerce tools, and typically runs on higher-profile sites, raising the stakes of this vulnerability. Once the attacker requests the uploaded file, the server's PHP interpreter executes its contents, giving the intruder arbitrary code execution with the web server's privileges. Administrators should update to Elementor Pro 4.2.2 or later immediately and audit their uploads directory for suspicious PHP files.