Wordfence says a critical arbitrary file upload flaw in Elementor Pro, a WordPress plugin with an estimated 6 million active installations, could let unauthenticated attackers upload executable PHP files and potentially take over a site. The issue, tracked as CVE-2026-32475 and rated 9.8 on the CVSS scale, was patched in Elementor Pro 4.2.2, and Wordfence is urging site owners to update immediately.
How the Elementor Pro flaw worked
The vulnerability affected Elementor Pro versions up to and including 4.2.1. Wordfence said the problem was in the plugin’s handling of File Upload fields inside its Form widget, specifically when the upload field was not marked as required.
In that configuration, an attacker could submit a crafted multi-part file upload where the first entry was empty and the second contained a malicious payload. The empty entry triggered an early return in the validation routine, which stopped the plugin from checking file types and sizes for the remaining entries in the same field.
That matters because the later processing step still handled the second file. Wordfence said the plugin used the filename extension supplied by the attacker, meaning a file named with a .php extension could be written to disk in the site’s uploads directory and then executed by the server if requested directly.
Why the bug could lead to remote code execution
The validation failure was not just a bypass of a cosmetic restriction. By allowing arbitrary file types through the upload path, the flaw created a route to remote code execution, which is one of the most serious outcomes in WordPress plugin security.
Once a PHP file lands in a web-accessible directory, an attacker may be able to trigger it over HTTP. That can open the door to webshell deployment, data theft, malware installation, or a full site takeover.
- Affected software: Elementor Website Builder Pro
- Affected versions: 4.2.1 and earlier
- Patched version: 4.2.2
- CVE: CVE-2026-32475
- CVSS score: 9.8, Critical
Conditions required for exploitation
Wordfence said exploitation was not automatic on every Elementor Pro installation. A targeted site needed to have a published page containing an Elementor Pro Form widget with at least one File Upload field that was not required.
The form submission endpoint itself was reachable by unauthenticated visitors, which is what made the issue particularly dangerous. An attacker did not need to log in or gain any prior access before attempting the upload attack.
The vulnerability sat in the plugin’s ajax_send_form() path and the associated upload validation logic. In Wordfence’s analysis, the buggy return should have been a continue, which would have skipped only the empty file entry instead of abandoning the rest of the validation loop.
Who reported it and when it was fixed
Wordfence said it received the submission on July 24, 2026, and validated the proof-of-concept exploit on July 27 before disclosing the issue to Elementor. The vendor later informed Wordfence that another researcher had also reported the bug, and Wordfence said it rejected its originally assigned CVE and used the vendor’s assigned identifier instead.
Elementor released the fully patched version, 4.2.2, on August 19, 2026. Wordfence is recommending that users update as soon as possible.
The original reporter named by Wordfence was Austin Ginder, who discovered and responsibly reported the issue through the Wordfence Bug Bounty Program. Wordfence said he received a bounty of $15,600 for the finding.
Protection for Wordfence users
Wordfence said all of its users are protected against exploit attempts targeting this vulnerability through the firewall’s built-in Malicious File Upload protection. That includes customers on Wordfence Premium, Care, and Response, as well as users on the free version.
The company also noted that this protection only works if the “Disable Code Execution for Uploads directory” option is enabled in Wordfence Global Options. It strongly recommended that users turn that setting on.
For site owners who are not using Wordfence, the practical takeaway is straightforward: update Elementor Pro to 4.2.2 and review any forms that include file upload fields, especially those that are optional.
Why this matters for WordPress sites
Arbitrary file upload bugs remain one of the most dangerous classes of web application vulnerability because they often bypass the normal boundary between user input and server-side code execution. In a WordPress context, that can be especially risky when uploads land in directories that are reachable from the web.
This case also shows how a small validation mistake can have major consequences. A single early return in the wrong place was enough to defeat the plugin’s intended file checks and let an attacker slip a dangerous file through a path meant for ordinary form attachments.
Site owners who depend on Elementor Pro should verify the installed version now, confirm that updates have been applied, and consider whether any forms exposing file upload fields are still necessary. If they are, security settings and server-side execution restrictions should be reviewed carefully.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: August 21, 2026 at 1:52 am
0 views
