Critical RCE Vulnerability in Elementor Pro Plugin Exposes WordPress Sites

A critical vulnerability, CVE-2026-32475, has been identified in the Elementor Pro WordPress plugin, affecting versions prior to 4.2.2. This flaw allows unauthenticated attackers to upload executable files via the File Upload module, leading to remote code execution. The vulnerability arises from separate loops for file validation and processing that handle empty filename uploads inconsistently. An attacker can exploit this by crafting a multipart upload with an empty filename followed by a malicious PHP payload. The vulnerability was reported by researcher Tin Pham on July 16, 2026, and a patch was verified by Patchstack on August 3, 2026. Elementor has urged all users to update to the latest version to mitigate risks. The plugin is widely used, with over 10 million active installations, increasing the potential impact of this vulnerability.

Key Points: • CVE-2026-32475 allows RCE via unauthenticated file uploads in Elementor Pro versions < 4.2.2. • The vulnerability stems from inconsistent handling of empty filename uploads in separate validation and processing loops. • Patchstack verified a fix on August 3, 2026; users are urged to update immediately.