Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
Patchstack researcher Tin Pham reported an unrestricted file upload flaw in Elementor Pro's Forms module (CVE-2026-32475, CVSS 9.0), affecting all versions up to and including 4.2.1. Submitting two file parts for one field bypasses the extension blocklist and writes attacker-controlled PHP into a public uploads directory, yielding unauthenticated remote code execution when a published Elementor page uses a Form widget with a File Upload field. A patched version 4.2.2 shipped August 19, 2026, a day after WordPress 7.0.4 fixed CVE-2026-65640 (CVSS 8.8), an RCE via Postscript file upload when Imagick and Ghostscript are in use.
- Flaw lives in the Forms module File Upload field; two file parts bypass the extension blocklist, writing PHP to a public directory.
- Affects Elementor Pro versions through 4.2.1; patch 4.2.2 released August 19, 2026.
- Requires a published Elementor page with a Form widget containing a File Upload field.
- Also covered: WordPress 7.0.4 fixing CVE-2026-65640, RCE via Ghostscript/Postscript upload by Author-level users.
- Vendors
- ElementorPatchstackWordPress
- Products
- Elementor ProWordPress
- Organizations
- PatchstackElementor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-32475 | Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin | 9.0 | 2% | ||
| CVE-2026-65640 | Author-Level RCE in WordPress Core via Malicious Postscript File Upload | 8.8 | 2% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 20, 2026 Vulnerability / Web Security Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475 , carries a CVSS score of 9. 0 out of 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.