Loading story…
A critical vulnerability in the Elementor Pro WordPress plugin, tracked as CVE-2026-32475, allows unauthenticated attackers to upload arbitrary files and achieve remote code execution on affected sites. The flaw impacts versions 4.2.1 and earlier and exists in the Forms module’s File Upload field, where file validation and file movement are handled inconsistently across separate loops. By crafting a multipart request with two file parts for the same field, an attacker can bypass extension checks and place a PHP file in the publicly accessible wp-content/uploads/elementor/forms/ directory.
The issue can be exploited when a published Elementor page includes a Form widget with a File Upload field, a configuration described as common because the field is not required by default. Researcher Tin Pham (TF1T) reported the bug through the Patchstack Bug Bounty Program, and Elementor addressed it in version 4.2.2 by aligning the loop logic and adding an extension check in the file-move path. Defenders were warned that upgrading does not remove files already uploaded through exploitation and should inspect the Elementor forms upload directory for unexpected PHP files.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request added a full Nuclei template and proof-of-concept for CVE-2026-32475, showing how Elementor Pro's form upload flow could write a PHP file despite returning a file-type rejection message. The material demonstrated retrieval and execution of the uploaded file, providing public technical exploitation details for the flaw.
Elementor Pro released version 4.2.2 to patch CVE-2026-32475, which affects versions 4.2.1 and earlier. The fix aligns validation and processing logic for file uploads and adds an extension check before moving uploaded files.
Patchstack said it verified Elementor's remediation for CVE-2026-32475 on August 3 after the developer prepared a fix following disclosure. This marked a separate coordination milestone before Elementor Pro 4.2.2 was publicly released.
Wordfence said it received a vulnerability submission for CVE-2026-32475 through its Bug Bounty Program. The report concerned an unauthenticated arbitrary file upload flaw in Elementor Pro that could lead to remote code execution.
Patchstack said it confirmed CVE-2026-32475 and disclosed the Elementor Pro arbitrary file upload vulnerability to the vendor after researcher Tin Pham (TF1T) reported it. The flaw can allow unauthenticated file upload leading to remote code execution on affected sites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
14 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceheise.de
Open sourcethehackernews.com
Open sourcecve.org
Open sourcepatchstack.com
Open sourcepatchstack.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-32475**, a critical unauthenticated arbitrary-file-upload vulnerability (CVSS 9.8) in Elementor Website Builder Pro for WordPress. The flaw affects versions through 4.2.1 and lets attackers bypass file-extension and type validation in published Elementor Pro Form widgets with non-required File Upload fields, upload PHP webshells, execute arbitrary commands, and potentially fully compromise affected sites. The vulnerability was fixed in Elementor Pro 4.2.2. Wordfence reported blocking more than 190,000 exploitation attempts shortly after public disclosure; administrators should update immediately and investigate Elementor form-upload directories for unauthorized PHP files, which are a key indicator of compromise.
Sep 6, 2026
A critical vulnerability in the **Forminator Forms** WordPress plugin exposed roughly **600,000 sites** to unauthenticated arbitrary file upload and potential remote code execution. Tracked as `CVE-2026-15748`, the flaw affects all versions through **1.56.1** and can be exploited when a form includes both a **File Upload** field and a **Select** field. Researchers said attackers could forge upload metadata and bypass file-type checks in the plugin's `handle_file_upload()` logic to upload malicious **PHP** files. In default configurations, uploaded files are usually stored in a directory protected by `.htaccess`, which can block direct execution, but sites using a custom upload storage root may lack that safeguard and be fully compromised. The vendor patched the issue in **Forminator Forms 1.56.2**. Separate reporting also highlighted another critical WordPress plugin issue: **User Profile Builder** `CVE-2026-15826`, an authentication bypass fixed in **3.16.5** that could let unauthenticated attackers log in as **user ID 1** when **Automatically Log In** is enabled.
Aug 25, 2026
More than 10,000 WordPress sites using the King Addons for Elementor plugin are at risk of total site compromise due to two critical vulnerabilities. The first flaw, an unauthenticated privilege escalation (CVE-2025-8489), allows attackers to register new accounts with administrator privileges by exploiting improper role restrictions in plugin versions 24.12.92 through 51.1.14. The second vulnerability, an unauthenticated arbitrary file upload (CVE-2025-6327), enables attackers to inject malicious files into various directories by abusing an AJAX handler's exposed nonce, further increasing the risk of site takeover. Security researchers from Patchstack and Wordfence have confirmed that both vulnerabilities are remotely exploitable and require no authentication, making them highly attractive targets for threat actors. Site administrators are strongly urged to update to patched versions of the plugin, which now include a role allowlist, improved input sanitization for account creation, and stricter file type validation in the upload handler. Immediate patching is recommended to prevent exploitation and potential full compromise of affected WordPress sites.
Jun 29, 2026