{"id":2450,"date":"2026-08-20T06:21:18","date_gmt":"2026-08-20T06:21:18","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2450"},"modified":"2026-08-20T06:21:18","modified_gmt":"2026-08-20T06:21:18","slug":"elementor-pro-flaw-could-let-unauthenticated-attackers-upload-php-and-execute-code","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2450","title":{"rendered":"Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 20, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.<\/p>\n

The vulnerability, tracked as CVE-2026-32475<\/a><\/strong>, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.<\/p>\n

\u00abThe flaw lives in the Forms module’s File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries,\u00bb Patchstack said<\/a>.<\/p>\n

\u00abBy submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory.\u00bb<\/p>\n

This discrepancy in how it validates the file’s extension and moves the uploaded file to a public directory when empty file entries are processed turns a restricted file-upload field into an unauthenticated remote code execution primitive.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Successful exploitation of the flaw could allow an attacker to upload arbitrary files, including PHP scripts, that could then be used to achieve remote code execution on affected systems. The security defect impacts all versions of the plugin prior to and including version 4.2.1.<\/p>\n

<\/p>\n

The WordPress security company said the only precondition required to pull off an attack is that the target site has at least one published Elementor page containing a Form widget with a File Upload field. The uploaded file is written as \u00abwp-content\/uploads\/elementor\/forms\/.php,\u00bb where \u00ab\u00bb is the output of PHP’s uniqid() function<\/a>.<\/uniqid><\/uniqid><\/p>\n

\u00abThis is an extremely common, everyday configuration: job-application forms, ‘attach a photo\/ID\/receipt’ forms, and support-ticket attachments all use it,\u00bb it noted. \u00abThe field’s ‘Required’ toggle being off is its default state, so no hardened or unusual setting is needed.\u00bb<\/p>\n

Security researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw under the Patchstack Bug Bounty Program. After the issue was reported to Elementor Pro on July 16, 2026, a patch (version 4.2.2) was released on August 19.<\/p>\n

The release comes a little over a week after WordPress released 7.0.4<\/a> to address a high-severity security issue (CVE-2026-65640<\/a>, CVSS score: 8.8) that enables remote code execution via malicious Postscript file upload by an Author-level user or higher. It affects WordPress core versions 4.7 all the way up to 7.0.<\/p>\n

However, for the attack to be successful, two conditions have to be satisfied –<\/p>\n