Cybersecurity researchers have disclosed particulars of a important flaw within the Elementor Professional WordPress plugin that, if efficiently exploited, might result in distant code execution.
The vulnerability, tracked as CVE-2026-32475, carries a CVSS rating of 9.0 out of 10.0. It has been described as a case of unrestricted add of a file with a harmful sort.
“The flaw lives within the Types module’s File Add discipline, the place the extension examine and the file-move step run in two separate loops with completely different dealing with of empty file entries,” Patchstack mentioned.
“By submitting two file elements for a similar discipline, an unauthenticated attacker skips the extension blocklist totally and writes a PHP file right into a public listing.”
This discrepancy in the way it validates the file’s extension and strikes the uploaded file to a public listing when empty file entries are processed turns a restricted file-upload discipline into an unauthenticated distant code execution primitive.
Profitable exploitation of the flaw might enable an attacker to add arbitrary recordsdata, together with PHP scripts, that would then be used to realize distant code execution on affected techniques. The safety defect impacts all variations of the plugin previous to and together with model 4.2.1.
The WordPress safety firm mentioned the one precondition required to tug off an assault is that the goal website has no less than one printed Elementor web page containing a Kind widget with a File Add discipline. The uploaded file is written as “wp-content/uploads/elementor/varieties/<uniqid>.php,” the place “<uniqid>” is the output of PHP’s uniqid() operate.
“That is an especially frequent, on a regular basis configuration: job-application varieties, ‘connect a photograph/ID/receipt’ varieties, and support-ticket attachments all use it,” it famous. “The sector’s ‘Required’ toggle being off is its default state, so no hardened or uncommon setting is required.”
Safety researcher Tin Pham (aka TF1T) has been credited with discovering and reporting the flaw underneath the Patchstack Bug Bounty Program. After the difficulty was reported to Elementor Professional on July 16, 2026, a patch (model 4.2.2) was launched on August 19.
The discharge comes just a little over per week after WordPress launched 7.0.4 to deal with a high-severity safety challenge (CVE-2026-65640, CVSS rating: 8.8) that permits distant code execution through malicious Postscript file add by an Writer-level person or greater. It impacts WordPress core variations 4.7 all the best way as much as 7.0.
Nevertheless, for the assault to achieve success, two situations should be glad –
- Imagick and Ghostscript in use on the server, given the difficulty is in Ghostscript’s dealing with of sure embedded recordsdata
- A malicious person with the upload_files functionality
The replace “adjustments how WordPress fingers your uploaded media to ImageMagick, and it closes a path that would let a logged-in writer flip an ordinary-looking picture add into code execution in your server,” Patchstack mentioned.
“When you run a multi-author publication, a membership website, a shopper website with contributors, or something with open or loosely managed registration, that bar is loads decrease than it sounds. On these websites, an Writer importing a booby-trapped ‘picture’ is a genuinely practical risk, not a theoretical one. If it is simply you and a tightly held set of trusted editors, your publicity is smaller.”
The findings additionally coincide with the invention of a large-scale operation dubbed StopAndProtect that is turning 1000’s of compromised WordPress web sites right into a distributed infrastructure for malware supply, command-and-control communications, and the storage of stolen information.
WordPress customers are suggested to maintain their web sites and plugins up-to-date, scan for unauthorized modifications that serve surprising redirects or pop-ups, and audit them for unknown accounts and plugins.
