Cybersecurity firm **Patchstack**, specializing in the **WordPress** ecosystem, has detailed a critical vulnerability in the **Elementor Pro** plugin. The flaw, designated **CVE-2026-32475**, allows for unauthenticated file uploads, potentially leading to Remote Code Execution (RCE) on affected servers. ### The Discrepancy in File Handling The vulnerability lies within the plugin's File Upload module, specifically in how it handles multipart uploads. According to **Patchstack**'s report, the core issue is a disagreement between the validation loop and the processing loop regarding empty file entries within a multipart upload. **PHP** reports these as `UPLOAD_ERR_NO_FILE`. "The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover," **Patchstack** clarifies. ### Crafting the Malicious Payload Attackers can exploit this by crafting a multipart upload where the first entry has an empty filename. This is followed by a second part containing a malicious **PHP** payload. The validation routine, upon encountering the empty first part, exits, dismissing it without checking subsequent parts. However, the processing step, which skips the empty entry, proceeds to move the malicious **PHP** file from the second part into a publicly accessible directory on the server, typically `wp-content/uploads/elementor/forms/`. ### Elementor Pro's Reach and Impact **Elementor Pro** is the paid version of **Elementor**, a highly popular drag-and-drop website builder for **WordPress**, boasting over 10 million active installations. The Pro version offers advanced features like form creation, theme builders, and e-commerce tools, making it a staple for more robust platforms. Exploitation of **CVE-2026-32475** requires only that the target site has a published **Elementor** form with an enabled File Upload field. ### From Upload to Execution After uploading the malicious **PHP** file, an attacker can determine its filename in the public directory. This is because the filename is generated using the `uniqid()` function, which is time-based rather than truly random. Researchers suggest that attackers could determine the filename through timing-based brute-force or, in some configurations, obtain the exact URL via an autoresponder email. Once the attacker requests the uploaded file at its URL, the server's **PHP** interpreter executes its contents, granting arbitrary code execution with the privileges of the web server. ### Disclosure and Mitigation **Patchstack** was alerted to the vulnerability by researcher **Tin Pham** on July 16. The information was promptly shared with the **Elementor** team, who prepared a fix the following day. **Patchstack** verified the fix on August 3, and the patched versions were released shortly thereafter. **Elementor** has notified its subscribers, clarifying that only "websites that use an **Elementor Pro** Form with an upload file form field, and the multiple file upload option enabled (it is disabled by default)" are at risk. Despite this, they recommend all sites update to the latest version to enhance security. Administrators are urged to update to the latest **Elementor Pro** release immediately. Furthermore, a thorough inspection of the `wp-content/uploads/elementor/forms/` directory for any suspicious **PHP** or other rogue files is highly recommended, as updating the plugin will not remove already uploaded malicious files. Currently, there have been no observed instances of active exploitation in the wild.