Post cover image
A logic flaw in Elementor Pro's Forms widget lets attackers upload a PHP web shell with zero authentication — here's how it works and how to check if you're exposed

August 22, 2026

Elementor Pro CVE-2026–32475 — Critical Unauthenticated RCE Vulnerability Explained

CRITICAL: Elementor Pro CVE-2026–32475 — Unauthenticated RCE Vulnerability Puts Millions of WordPress Sites at Risk

By Xpert4Cyber

1 min read

A newly disclosed critical vulnerability (CVSS 9.0) in Elementor Pro — one of the most widely used WordPress page builders, powering an ecosystem of 10M+ installs — allows completely unauthenticated attackers to upload a malicious PHP web shell and achieve full remote code execution on your site.

No login. No password. No CSRF token. No prior account. Just a single crafted multipart form submission through Elementor's Forms widget File Upload field, and an attacker can drop a working web shell directly into a publicly accessible directory.

What's affected: Elementor Pro versions 4.2.1 and earlier are exploitable. Version 4.2.2, released August 19, 2026, contains the fix.

How the exploit works: The vulnerability stems from a logic mismatch between Elementor's file validation loop and its file processing loop when handling an empty filename in a multipart upload. By submitting two file parts under the same upload field — one with an empty filename, one carrying a disguised PHP payload — an attacker can bypass the extension blocklist entirely. The malicious file then lands in a web-accessible uploads directory and executes at the privilege level of the web server itself.

Why this matters right now: Unauthenticated, low-complexity file-upload-to-RCE vulnerabilities in widely deployed plugins are exactly the kind of bug that gets automated into mass-scanning botnets within days of public disclosure. If you manage WordPress sites for clients, especially ones with job application forms, support portals, or vendor onboarding pages using Elementor Forms, this needs to be treated as an emergency patch, not a backlog ticket.

In the full technical breakdown, I cover: — The exact exploit mechanics, step by step — Indicators of compromise to hunt for on your own sites — WP-CLI and log-grep commands to check exposure and detect active compromise — A prioritized detection and prevention checklist for security teams and WordPress agencies

Read the complete write-up here: https://www.xpert4cyber.com/2026/08/elementor-pro-rce-vulnerability.html

If you work in WordPress security, incident response, or manage a client site fleet, this is worth 5 minutes of your time today.