CVE-2026-32475: Elementor Pro ≤4.2.1 Exposed to Unauthenticated…

A critical CVSS 9.0 vulnerability in Elementor Pro allows unauthenticated PHP file upload. The fix sat ready for 34 days before release.

On August 19, 2026, Elementor released version 4.2.2, which fixes CVE-2026-32475, a CVSS 9.0 vulnerability in Elementor Pro's File Upload feature. The bug lets anyone upload executable PHP code without authentication, but the fix was ready on July 17. The 34-day gap between a developed fix and its official release raises an uncomfortable question: why doesn't the WordPress plugin supply chain enforce embargo mechanisms for flaws this severe.

Key Takeaways

CVE-2026-32475 carries a CVSS 9.0 score and is classified as critical under the MITRE framework.
The attack requires only a public page with a Form widget and File Upload field, an extremely common configuration for job applications, support tickets, and receipts.
The mechanism exploits a desynchronization between the validation and processing loops in upload.php, where an empty filename in the first part bypasses the extension blocklist.
Updating to 4.2.2 closes the vulnerability but does not remove any malicious files already uploaded, according to the source.

How the Attack Works: Two Loops, One Loophole

The flaw resides in modules/forms/fields/upload.php. When a form receives a multipart upload, the validation() function iterates through the file parts. If the first part has an empty filename, it returns UPLOAD_ERR_NO_FILE and exits early. The process_field() function, however, skips the empty part and continues processing subsequent parts.

An attacker sends two parts for the same field: the first with an empty filename, the second with a PHP payload. The validator sees the error and deems the request safe; the processor writes the file to wp-content/uploads/elementor/forms/<uniqid>.php. The directory is public, and the file is executable.

"The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover" — Patchstack, via BleepingComputer

Determining the Filename: Brute-Force or Exfiltration

The filename generated via uniqid() is predictable: the first 8 hexadecimal characters correspond to the epoch in seconds, the remaining 5 to microseconds. According to available technical analyses, an attacker can derive the temporal portion from the HTTP response Date header and brute-force the remainder with a limited number of attempts.

An alternative path also exists. The Elementor form autoresponder, if configured, includes the exact URL of the uploaded file. This allows remote execution without any brute-force, reducing the attack to a single HTTP request.

Trivial Precondition, Vast Attack Surface

The vulnerability requires no credentials, session cookies, or special privileges. The only prerequisite is a public page with a Form widget containing a File Upload field. The Required field is disabled by default in the Elementor interface, meaning the form accepts submission even without a legitimate file.

Patchstack characterized this configuration as "extremely common, everyday." Job applications, photo/ID attachments, payment receipts, support tickets — all use the File Upload widget. The necessary identifiers — post ID, form ID, field name — are readable in the public page's HTML source.

"By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory" — Patchstack, via The Hacker News

Timeline: 34 Days Between Ready Fix and Release

Researcher Tin Pham, known as TF1T, reported the vulnerability through the Patchstack Bug Bounty Program on July 16, 2026. Elementor prepared the fix the next day. Internal verification completed on August 3. Version 4.2.2 shipped on August 19.

The brief does not document the official reason for this delay. What the sources confirm is the interval: 34 days during which the corrected code existed but was not distributed to users. No forced-update mechanism or embargo enforcement accelerated the rollout for a vulnerability classified as critical.

No Exploitation Observed, But Posture Shifts After Disclosure

At the time of publication, sources agree on reporting no active in-the-wild exploitation. This data refers to the moment of disclosure and does not rule out subsequent developments. The fully unauthenticated nature of the vector, the payload's reproducibility, and the filename's predictability significantly lower the barrier for opportunistic operators.

Why This Matters

The brief does not specify additional remedial measures recommended by Elementor or Patchstack beyond updating to 4.2.2. The source does not list pre-existing integrity checks, filesystem scans, or post-patch verification procedures. The dossier does not document whether Elementor directly notified Pro users or if a dedicated security advisory channel exists.

The 34-day gap raises a structural problem. WordPress lacks mandatory forced-update mechanisms for premium plugins; responsibility remains with individual site managers. For a CVSS 9.0 vulnerability with an unauthenticated attack vector, this model distributes risk across millions of installations without guarantees of timely coverage.

The impact is not theoretical. Elementor is among the most widely deployed builders in the WordPress ecosystem; the free version exceeds 10 million active installations. Elementor Pro, distributed under a commercial license, powers business sites, e-commerce stores, and membership platforms where full server compromise has direct consequences for customer data and operations.

"Updating closes the hole but does not remove a shell already on disk," notes the Patchstack analysis via CyberKendra. The update is a necessary but insufficient condition for remediation. The source does not specify whether Elementor released guidance for auditing pre-existing files, leaving an operational point of uncertainty for administrators.

Questions and Answers

Is my Elementor Pro installation at risk if I don't use forms with upload?

The brief documents that the vulnerability triggers through the Form widget's File Upload field. If the site does not expose forms with this function enabled, the specific vector is not available. The source does not cover other attack paths for CVE-2026-32475.

Didn't WordPress automatic updates protect sites?

The brief does not document whether Elementor Pro 4.2.2 was distributed via automatic update or requires manual intervention. WordPress enables auto-updates for plugins in the public repository, not necessarily for premium plugins distributed through proprietary channels.

How can I verify if my site has already been compromised?

The source does not provide specific indicators of compromise or known file hashes. The brief does not list commands, typical shell paths, or malicious request patterns to search for in logs. Post-incident analysis is not documented in the available sources.

Information is based on the cited advisory and current as of publication.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references