Skip to content

Back to the catalog

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites
orca.securityadvisory

Critical Elementor Pro File Upload Flaw Enables Unauthenticated Remote Code Execution on WordPress Sites

CVE-2026-32475 (CVSS 9.0) is an unauthenticated arbitrary file upload leading to RCE in Elementor Pro's Forms module (versions up to 4.2.1), caused by the extension-blocklist check and the file-move step running in two separate loops with different empty-file handling, letting a two-part file submission bypass the blocklist and drop a PHP webshell into the public wp-content/uploads/elementor/forms/ directory. The post also flags related WordPress core CVE-2026-65640 (CVSS 8.8, fixed in 7.0.4), an Author-level RCE via malicious PostScript upload requiring Imagick and Ghostscript. Fix: upgrade Elementor Pro to 4.2.2+ and WordPress core to 7.0.4, and audit the uploads/elementor/forms directory for planted PHP files.

TL;DR Unauthenticated file-upload bypass in Elementor Pro Forms (CVE-2026-32475, CVSS 9.0) lets attackers drop a PHP webshell for full RCE; patch to 4.2.2+.
Open original ↗

Organisations named here

  • extension blocklist bypass

CVEs named here

  • CVE-2026-32475
  • CVE-2026-65640

Technologies named here

  • Orca
  • Elementor Pro
  • WordPress Core
  • WordPress
  • PHP
  • Orca Security
  • CVSS

Techniques named here

  • Extension blocklist bypass via dual-loop file upload logic
  • Webshell placement in publicly accessible upload directory
  • Arbitrary file upload

Related in AppSec