GoKawiilA critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.
Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently.
“The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem.
“The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.”
An attacker could exploit this behavior by crafting a multipart upload in which the first entry has an empty filename, followed by a malicious PHP payload.
This causes the validation routine to exit after examining the first part, dismissing it with the UPLOAD_ERR_NO_FILE error and never checking the second part. The processing step skips the empty entry but goes through the rest of the upload and moves to a public directory (wp-content/uploads/elementor/forms/) the PHP in the second part.
Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has more than 10 million active installs.
The Pro version adds more advanced features such as form creation, theme and popup builders, custom code and CSS, and e-commerce tools, and is generally used by higher-grade platforms.
According to Patchstack, exploiting CVE-2026-32475 requires only that the target site have a published Elementor form containing a File Upload field.
The researchers say that after uploading the malicious PHP, an attacker can determine its filename in the public directory because it is created using the uniqid() function, which is not random but time-based.
... continue reading