Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks
Brief
A critical security flaw in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload malicious PHP files and execute code on vulnerable servers.
Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro versions up to and including 4.
- 1 and is fixed in version 4.
- 2.
Elementor Pro is a premium extension for the Elementor page builder. Its Forms widget lets website owners create contact, job application, support, and document-submission forms. The vulnerable feature is the File Upload field that allows visitors to attach files.
The flaw exists because the plugin handles file validation and file storage in separate loops. Under normal conditions, Elementor Pro checks uploaded file extensions against an allowlist and a blocklist. Dangerous extensions such as . php, . phtml, . asp, and . exe should be rejected.