Elementor Pro RCE Flaw Requires Urgent Update

The Elementor Pro RCE flaw could allow attackers to upload malicious files and execute code on vulnerable WordPress servers. The critical vulnerability affects Elementor Pro versions released before 4.2.2.

Tracked as CVE-2026-32475, the issue sits in the plugin’s File Upload module. It affects websites that use an Elementor Pro form with a file-upload field and have enabled multiple file uploads.

Elementor has released a security update. Website owners should install the latest version and inspect their servers for suspicious files.

File upload checks can miss malicious payloads

The vulnerability results from a mismatch between two parts of the file-upload process. One part validates uploaded files, while another processes and moves them to the server.

An attacker can craft a multipart upload that starts with an empty filename. The validation process stops after finding that empty entry and does not review the following file.

However, the processing step skips the empty item and continues with the rest of the upload. It can then place a malicious PHP file in a public Elementor forms directory.

This difference allows an attacker to bypass the intended upload validation. Once the server stores the PHP file, an attacker may request it through a browser and trigger code execution.

Attackers may predict uploaded file locations

The uploaded file receives a name generated with the PHP uniqid() function. This method uses time-based values rather than fully random names.

As a result, attackers may predict the filename through timing attempts. In some site configurations, an automatic email response could also reveal the direct location of the uploaded file.

If the attacker finds the file’s URL, the web server can execute its contents. That could give the attacker control with the same permissions available to the web server process.

The Elementor Pro RCE flaw requires a published form with the relevant upload settings. Still, affected forms can expose an otherwise well-maintained WordPress site to a serious attack.

Update Elementor Pro and inspect uploaded files

Elementor prepared a fix shortly after receiving the vulnerability report. The vendor later verified the patch and released it to customers.

Administrators should update Elementor Pro to version 4.2.2 or the latest available release. They should also check the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other suspicious uploads.

Applying the update blocks future exploitation. However, it does not remove files that an attacker may have uploaded before the site received the fix.

Security teams should review server logs, inspect recently modified files and remove unauthorised content after preserving evidence for investigation. They should also confirm that forms use only the features required for normal operation.

Most Elementor sites are not affected

The issue does not affect every website that uses Elementor. A site must run Elementor Pro, use a form with a file-upload field and enable the multiple-upload option.

The multiple-upload setting is disabled by default. Even so, all Elementor Pro users should install current updates to reduce security and compatibility risks.

No active exploitation has been reported at this stage. The severity of the vulnerability still makes prompt patching important.

Conclusion

The Elementor Pro RCE flaw CVE-2026-32475 can expose specific WordPress forms to malicious file uploads and server-side code execution. Update Elementor Pro immediately, inspect the forms upload directory and investigate any unexpected files.