Critical Elementor Pro File Upload Flaw Enables Unauthenticated RCE

A critical vulnerability in the Elementor Pro WordPress plugin, tracked as CVE-2026-32475, allows unauthenticated attackers to upload arbitrary files and achieve remote code execution on affected sites. The flaw impacts versions 4.2.1 and earlier and exists in the Forms module’s File Upload field, where file validation and file movement are handled inconsistently across separate loops. By crafting a multipart request with two file parts for the same field, an attacker can bypass extension checks and place a PHP file in the publicly accessible wp-content/uploads/elementor/forms/ directory.

The issue can be exploited when a published Elementor page includes a Form widget with a File Upload field, a configuration described as common because the field is not required by default. Researcher Tin Pham (TF1T) reported the bug through the Patchstack Bug Bounty Program, and Elementor addressed it in version 4.2.2 by aligning the loop logic and adding an extension check in the file-move path. Defenders were warned that upgrading does not remove files already uploaded through exploitation and should inspect the Elementor forms upload directory for unexpected PHP files.