CVE-2026-32475 is a critical remote code execution vulnerability in Elementor Pro versions prior to 4.2.2. It arises from a logic discrepancy in the File Upload module where the validation loop exits early on an empty filename upload part (UPLOAD_ERR_NO_FILE), ignoring subsequent parts, while the processing loop continues and moves files to a public directory. An attacker can exploit this by sending a multipart upload with an initial empty filename part followed by a malicious PHP payload. The payload is saved in wp-content/uploads/elementor/forms/ with a predictable filename generated by uniqid(), allowing attackers to locate and execute it via the web server's PHP interpreter. Exploitation requires the target site to have an Elementor Pro form with a File Upload field and multiple file upload enabled (disabled by default). The vulnerability was responsibly disclosed to Elementor, which released a patch shortly after discovery. Users are advised to update to version 4.2.2 or later and inspect upload directories for malicious files.

Successful exploitation allows remote attackers to execute arbitrary PHP code on the web server with the privileges of the web server process. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or pivoting to other network resources. The vulnerability specifically affects sites using Elementor Pro forms with file upload fields and multiple file upload enabled. No active exploitation has been reported in the wild at this time.

A patch has been released by Elementor in version 4.2.2 that fixes this vulnerability. Site administrators should update Elementor Pro to version 4.2.2 or later immediately. Additionally, administrators should inspect the wp-content/uploads/elementor/forms/ directory for any unauthorized PHP or suspicious files uploaded during the vulnerable period and remove them. Since the vulnerability requires the multiple file upload option enabled in forms (disabled by default), disabling this option can reduce exposure if immediate patching is not possible. No other action is required if the site does not use Elementor Pro forms with file upload fields.