CVE-2026-32475

Executive Summary

CVE-2026-32475 is a critical unrestricted file upload vulnerability affecting Elementor Pro versions up to and including 4.2.1. The flaw allows unauthenticated attackers to upload malicious files to affected WordPress installations, potentially leading to remote code execution and full site compromise. With a CVSS score of 9.0 and no patch currently available, this vulnerability represents a severe and immediate risk to all Elementor Pro users on vulnerable versions.

Technical Analysis

CVE-2026-32475 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The NVD description states that the vulnerability exists in the Elementor Pro plugin for WordPress and "allows Using Malicious Files." The affected version range is from n/a through 4.2.1.

The vulnerability mechanism falls within the unrestricted file upload vulnerability class. In this class of flaws, the application fails to properly validate the type, content, or extension of files submitted by users. An attacker can exploit this by submitting a file that contains executable code but is disguised with an allowed extension or MIME type. When the server stores the file and the web application later serves it, the uploaded file can be executed by the web server, resulting in remote code execution.

The CVSS vector for this vulnerability is particularly telling: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The attack vector is network-based (AV:N), requiring no authentication (PR:N) and no user interaction (UI:N). The attack complexity is rated high (AC:H), suggesting that specific conditions must be met for a successful exploit, but the scope is changed (S:C), meaning the impact extends beyond the vulnerable component. The confidentiality, integrity, and availability impacts are all rated high (C:H/I:H/A:H).

For the Elementor Pro context, the attack surface is the file upload functionality within the plugin. Elementor Pro includes file upload features in its form builder, which allows WordPress site visitors to submit files through custom forms. These uploads may be processed, stored, and served by the web server.

Critical technical considerations: The NVD description does not provide specific implementation details about how the file validation is (or is not) performed. We do not have information about specific function names, class names, file paths, or URL endpoints involved in the vulnerability. Conventional file upload validation checks include MIME type validation, file extension allow/deny lists, content inspection (magic bytes), and size limits. Given the CVSS attack complexity rating of "High," it is plausible that some rudimentary validation exists but can be bypassed, or that the vulnerable configuration requires specific settings to be in place.

The absence of a patch (patch confidence 0/4) indicates this is a zero-day or unpatched vulnerability at the time of this report. No CVEs in the same vector or related patches were observed from any tracked source.

Exploitation Scenarios

Step 1: Reconnaissance/Target Identification An attacker first identifies WordPress sites running Elementor Pro version 4.2.1 or earlier. This can be done through:

• Shodan or Censys searches for HTTP headers or HTML content containing Elementor markers
• Banner grabbing on exposed WordPress login and admin endpoints
• Checking the site source code for "elementor-pro" CSS classes or JavaScript handles
• Using WordPress vulnerability scanners that enumerate plugin versions

Step 2: Triggering the Flaw Once a vulnerable target is identified, the attacker locates any page on the site that uses Elementor Pro's form widgets with file upload capability. These form widgets are typically present on contact pages, job application pages, or registration forms. The attacker will submit the upload form with a malicious file payload.

Step 3: Payload/Execution Method The attacker crafts a file containing server-side executable code (e.g., PHP code for a WordPress stack) with an extension or MIME type that passes whatever validation exists in the vulnerable plugin version. Examples at the vulnerability-class level include:

• Renaming a PHP web shell to file extensions that bypass naive extension allowlists
• Manipulating MIME type headers to match accepted types while preserving executable content
• Embedding backdoor code in files with dual functionality (e.g., polyglot files)
• Uploading files that can be executed through secondary include or access mechanisms

Step 4: Post-Exploitation Impact Upon successful upload and storage, the attacker locates the uploaded file path (which may be predictable or discoverable through directory traversal information) and directly requests the file from the web server. If the file executes, the attacker gains code execution in the context of the web server (typically www-data on Linux or IIS AppPool on Windows).

The CVSS scope change (S:C) indicates the impact moves beyond the vulnerable file upload component. With code execution, the attacker can:

• Read and modify the WordPress configuration file (wp-config.php) which contains database credentials
• Access the WordPress admin interface with elevated privileges
• Install additional malicious plugins or themes
• Pivot to the underlying database and extract sensitive user data
• Use the compromised host as a foothold for lateral movement into other infrastructure

The high attack complexity (AC:H) may mean that successful exploitation requires specific environmental preconditions, such as particular WordPress/PHP configurations, certain upload directory permissions, or the presence of additional vulnerable components.

Important: No public PoC for this vulnerability was identified at the time of this report. The attack chain described above is inferred from the vulnerability class (CWE-434) and the CVSS vector. Specific implementation details of the exploit are not known with certainty.

Impact Assessment

Business Impact: Critical

The CVSS base score of 9.0 places this vulnerability in the critical severity range. The full impact summary:

• Confidentiality (High): Attackers can read arbitrary files on the compromised server, access database contents, steal customer data, credentials, and intellectual property.
• Integrity (High): Complete site defacement, content manipulation, backdoor installation, and data tampering are possible.
• Availability (High): The compromised site can be rendered unusable through destructive actions, ransomware, or resource consumption attacks.

Affected Systems: All WordPress installations running Elementor Pro through version 4.2.1. Elementor Pro is one of the most widely deployed commercial WordPress plugins, with hundreds of thousands of active installations globally. The affected population spans all industry verticals including e-commerce, SaaS, healthcare, education, and government sites.

Blast Radius: The scope change (S:C) in the CVSS vector means the impact extends beyond the vulnerable component. Given that Elementor Pro integrates deeply with WordPress core, the CMS database, web server, and potentially adjacent infrastructure, the blast radius encompasses the entire web application stack and any connected systems (e.g., database servers, file storage services, email servers through SMTP misconfiguration).

Exploitability Considerations: The unauthenticated nature (PR:N) combined with network accessibility (AV:N) makes this exploitable from anywhere on the internet. While attack complexity is high, this only raises the bar for the initial exploit — it does not prevent dedicated attackers from achieving success. The typical difficulty mitigations for high complexity attacks are often overcome by adversaries through targeted research and tooling.

Regulatory Impact: A breach through this vulnerability could trigger mandatory disclosure obligations under multiple regulations including GDPR, HIPAA, and PCI-DSS, depending on the data processed by the affected site. Remediation costs, legal liabilities, and brand damage can be substantial.

Detection Guidance

Sigma Rule

title: Suspicious File Upload to Wordpress Elementor Pro
id: 2a0de9db-032d-4557-8a1d-4a3a0d4d61e8
status: experimental
description: Detects attempts to upload potentially malicious files through Elementor Pro form submissions
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32475
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Wordpress instances'
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'wp-content/uploads/elementor/'
            - 'elementor-pro'
            - 'wp-json/elementor'
    selection_suspicious_ext:
        c-uri|endswith:
            - '.php'
            - '.phtml'
            - '.php3'
            - '.php4'
            - '.php5'
            - '.shtml'
            - '.pht'
            - '.cgi'
            - '.sh'
            - '.jsp'
    selection_webshell:
        c-uri|contains:
            - 'cmd='
            - 'whoami'
            - 'eval('
            - 'base64_decode'
    condition: selection_upload and (selection_suspicious_ext or selection_webshell)
    timeframe: 10m
falsepositives:
    - Legitimate administrative uploads of PHP files through Elementor Pro
    - Development environments with active testing
level: high

YARA Rule

rule CVE_2026_32475_Elementor_Pro_Malicious_Upload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious file uploads targeting Elementor Pro unrestricted upload vulnerability"
        date = "2026-01-15"
        cve = "CVE-2026-32475"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-32475"
    strings:
        $elementor_part = "elementor-pro" ascii nocase
        $elementor_upload = "wp-content/uploads/elementor" ascii nocase
        $php_open = "<?php" ascii
        $php_short = "<?=" ascii
        $eval_func = "eval" ascii nocase
        $base64 = "base64_decode" ascii nocase
        $shell_cmd = "shell_exec" ascii nocase
        $system_call = "system(" ascii nocase
        $passthru = "passthru" ascii nocase
        $exec_func = "exec(" ascii nocase
        $webshell_names = {"(?:c99|r57|b374k|c100|wso|alfashell)"} ascii nocase
    condition:
        uint16(0) == 0x0D0A or
        (
            filesize < 5MB and
            ($elementor_part or $elementor_upload) and
            ($php_open or $php_short) and
            (
                $eval_func or $base64 or $shell_cmd or $system_call or
                $passthru or $exec_func or $webshell_names
            )
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-32475 - Elementor Pro Malicious File Upload Attempt"; flow:established,to_server; content:"POST"; http_method; content:"wp-content/uploads"; http_uri; nocase; content:"elementor"; http_uri; nocase; content:".php"; http_uri; nocase; content:"Content-Disposition"; http_header; nocase; content:"filename"; http_header; nocase; pcre:"/filename\s*=\s*["']?[^"';\r\n]+\.(?:php|phtml|php3|php4|php5|php7|pht|shtml|cgi|sh|jsp|war)\b/i"; reference:cve,2026-32475; classtype:web-application-attack; sid:10032475; rev:1;)

Elastic Detection

// Elastic EQL detection for CVE-2026-32475 exploitation attempts
sequence by host.id, user.name with maxspan=2m
  [ network where event.type == "start" and destination.port == 443 and
    url.path like~ "*elementor*" and
    http.request.method == "POST" and
    url.path like~ "*upload*"
  ]
  [ file where event.type == "creation" and
    (file.name like~ "*.php" or file.name like~ "*.phtml" or file.name like~ "*.php5") and
    file.path like~ "*uploads*elementor*" and
    (file.size >= 1024 and file.size <= 5000000)
  ]
  [ process where event.type == "start" and
    process.working_directory like~ "*uploads*elementor*" and
    (process.name like~ "sh" or process.name like~ "bash" or process.name like~ "php")
  ]

Splunk SPL Query

index=web earliest=-30d latest=now
| where like(uri_path, "%wp-content/uploads/elementor%") AND method="POST"
| rex field=uri_path "(?<uploaded_file>[\w\-\.\/]+\.(?:php\d*|phtml|pht|shtml|cgi|sh|jsp|war))"
| search uploaded_file=*
| rex field=_raw "Content-Disposition: form-data; name=\"(?<field_name>[^\"]+)\"; filename=\"(?<filename>[^\"]+)\""
| stats count by src_ip, host, uri_path, filename, uploaded_file, status
| where count > 5
| table _time, src_ip, host, uri_path, filename, uploaded_file, status, count
| sort - _time

Wazuh OSSEC Rule

<group name="web,wordpress,elementor,">
  <rule id="100325" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(php|phtml|php3|php4|php5|pht|shtml|cgi|sh|jsp|war)$</field>
    <field name="url" type="pcre2">(?i)elementor|wp-content/uploads</field>
    <description>CVE-2026-32475 - Attempted malicious file upload to Elementor Pro</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>wordpress_attack</group>
  </rule>

  <rule id="100326" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="url" type="pcre2">(?i)elementor/forms|elementor-pro</field>
    <field name="response">200</field>
    <description>CVE-2026-32475 - Successful POST to Elementor upload endpoint</description>
    <group>wordpress_attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

At the time of this report, no vendor patch is available for CVE-2026-32475. The vendor fix is listed as N/A, and no workarounds have been officially provided by Elementor.

1) Immediate Mitigations (apply immediately)

• Disable Elementor Pro file upload functionality: If possible, temporarily disable or restrict the file upload features in Elementor Pro forms until a patch is released. This can be done by removing upload field widgets from all forms.
• Harden the upload directory: If disabling uploads is not feasible, apply strict filesystem permissions to the WordPress uploads directory. Ensure the web server cannot execute files in the uploads directory using one of these approaches:
  • Configure the web server to disable script execution in wp-content/uploads/ via .htaccess (Apache) or location blocks (Nginx).
  • Set directory permissions to 755 or 750, denying write access to non-privileged web server users where possible.
• Implement a Web Application Firewall (WAF): Deploy or configure a WAF with rules to inspect file upload requests for known malicious signatures, disallowed file extensions, and suspicious content. This is the most effective immediate control.
• Block or restrict IP addresses: Monitor and block the IP addresses of entities that attempt to submit unusual or suspicious file uploads through Elementor Pro forms, particularly if repeated attempts are observed.

2) Patch/Upgrade Steps

• Monitor Elementor's official channels (https://elementor.com, plugin update notifications, WordPress security advisories) for a patched version of Elementor Pro.
• When a patched version is released, upgrade immediately. The vulnerable version range is all versions through 4.2.1. Any version released after 4.2.1 should be treated as the primary candidate for the fix.
• Prioritize patching: Given the critical severity (CVSS 9.0), Elementor Pro updates should be treated with the highest priority in the patching queue, above all other non-critical updates.
• Add to vulnerability monitoring: Register for CVE alert notifications from the NVD and vendor channels to receive immediate notification when patch information becomes available.

3) Long-Term Hardening

• Regular plugin update cadence: Establish a weekly (or more frequent) schedule for updating all WordPress plugins including commercial ones like Elementor Pro.
• WordPress hardening best practices:
  • Keep WordPress core updated to the latest stable release.
  • Remove unused plugins and themes to reduce attack surface.
  • Use least-privilege principles for database accounts used by WordPress.
  • Enable two-factor authentication (2FA) for all administrative accounts.
• Web server security:
  • Disable unnecessary server-side scripting modules (e.g., PHP-FPM, mod_php) in uploads directories.
  • Use Content Security Policy (CSP) headers to constrain what browsers can execute.
  • Implement specific upload directory execution restrictions in the web server configuration.
• Deploy file integrity monitoring: Implement tools (e.g., Wazuh, Tripwire, AIDE) to detect unauthorized file creation or modification in the WordPress directory tree.
• Security awareness: Train developers and site administrators on secure file upload practices and WordPress plugin risk assessment.
• Consider a managed WordPress firewall: Services like Cloudflare WAF or Sucuri provide an additional protective layer that can block exploit attempts before they reach the vulnerable application.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-32475 (Primary vulnerability database record, including full CVSS vector and description.)

2. MITRE ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — the relevant ATT&CK technique for this vulnerability's exploitation chain.)

3. CWE-434 — Unrestricted Upload of File with Dangerous Type — https://cwe.mitre.org/data/definitions/434.html (Detailed technical description of the vulnerability class, including common mitigations and typical exploitation techniques.)

4. Elementor Official Security Advisories — https://elementor.com/help/security-advisories/ (Vendor security notification channel. Monitor for future patch announcements regarding CVE-2026-32475.)

5. WordPress Plugin Vulnerability Database — https://wpscan.com/plugins/elementor-pro/ (WordPress-specific vulnerability tracking for Elementor Pro. WPScan may provide early patch notifications or exploit disclosures.)

Threat Actor Activity: As of this report date, no known threat actor campaigns specifically tied to CVE-2026-32475 have been publicly confirmed. However, given the critical severity and unattended patch status, the risk of active exploitation is considerable. The CVE-2026-32475 family of vulnerabilities is frequently targeted by automated scanning tools and botnet-driven mass exploitation. Organizations using Elementor Pro should operate under the assumption that this vulnerability will be actively exploited or integrated into automated exploit kits in the near term.