Critical Elementor Pro Flaw Allows Remote Code Execution

A critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload PHP files and execute remote code ^[1], ^[2].

This flaw is significant because it grants outsiders the ability to take full control of affected websites without needing login credentials. Because Elementor Pro is widely used for site design, the potential attack surface covers thousands of WordPress installations globally.

Cybersecurity researchers disclosed the vulnerability, identified as CVE-2026-32475 ^[1]. The flaw exists within the plugin's Forms module, where the system handles file uploads ^[1], ^[2]. The researchers said the module lacks proper validation, a failure that allows attackers to bypass security checks and upload executable PHP files directly to the server ^[2].

The vulnerability carries a CVSS severity score of 9.0 out of 10 ^[1]. This high score reflects the ease of exploitation and the severity of the impact, which is categorized as remote code execution ^[1]. Once a PHP file is uploaded and executed, an attacker can run arbitrary commands on the host server, potentially stealing data or defacing the site.

Unauthenticated attackers can bypass these file checks to initiate the attack ^[2]. This means the actor does not need an account or administrative privileges to compromise the site. The flaw stems specifically from how the Forms module processes incoming data, failing to verify the type and safety of uploaded files before they are stored on the server ^[1], ^[2].

Site administrators using Elementor Pro are encouraged to review their plugin versions and apply any available security patches immediately to mitigate the risk of a breach.