Critical Elementor Pro bug exposes WordPress sites to RCE attacks
Critical Elementor Pro bug allows RCE via malicious file uploads.
A critical vulnerability (CVE-2026-32475) in Elementor Pro for WordPress allows attackers to upload executable files for remote code execution. The flaw stems from how the File Upload module handles empty filenames, enabling attackers to bypass validation and upload malicious PHP payloads to public directories. Exploitation requires a site to have an Elementor form with a File Upload field and the multiple file upload option enabled.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Elementor?
Get an email when a new story names Elementor, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files by exploiting improper handling of empty filenames in the File Upload module, bypassing validation controls entirely. Once a malicious payload lands in a publicly accessible directory, attackers can execute arbitrary code on the server, leading to full site compromise. This matters because WordPress plugins represent one of the largest attack surfaces for web infrastructure, and file upload vulnerabilities are among the most dangerous classes of flaws due to their direct path to remote code execution. Sites that had enabled the multiple file upload option in Elementor forms were particularly exposed, illustrating how specific feature configurations can dramatically increase risk even within a trusted plugin.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-32475