A critical vulnerability in Elementor Pro exposes hundreds of thousands of WordPress sites to remote code execution attacks from unauthenticated threat actors.
The flaw, tracked as CVE-2026-32475, received a CVSS score of 9.0, placing it in the critical severity category. Researchers identified the vulnerability in the Forms module, where inadequate validation on file uploads allows attackers to bypass restrictions and upload PHP files directly to compromised servers. An unauthenticated attacker needs only to interact with an affected form to trigger malicious code execution with the privileges of the web server process.
Elementor Pro powers form handling for an estimated 3 million WordPress installations. The plugin's Forms module processes user submissions across e-commerce sites, lead generation platforms, and content repositories. Because the vulnerability requires no authentication, any visitor to a website running the affected version can exploit it. This creates a wormable scenario where automated scanning tools can identify vulnerable instances at scale.
The attack chain operates simply. An attacker sends a specially crafted form submission containing a PHP payload disguised as an uploaded file. The Forms module fails to properly validate file type restrictions, allowing the PHP file to land in a web-accessible directory. The attacker then accesses the uploaded file directly through the browser, triggering PHP execution on the server. From this position, attackers gain full shell access, permit lateral movement into databases, steal customer records, inject malicious content, or deploy ransomware payloads.
Organizations running Elementor Pro face immediate business risk. E-commerce platforms risk credit card data theft and PCI DSS compliance violations. SaaS applications and membership sites risk customer account compromises. News outlets and corporate websites risk defacement and SEO poisoning through injected content. Attackers often install web shells and backdoors to maintain persistence after the initial breach, complicating remediation efforts weeks or months later.
The Forms module ships as a core feature in Elementor Pro packages, and many site administrators may not realize they run vulnerable code. WordPress sites frequently operate with outdated plugins due to insufficient update discipline or testing overhead in staging environments. Legacy installations, particularly those managed by agencies handling hundreds of client sites, amplify the risk surface.
Elementor has released patched versions addressing CVE-2026-32475. WordPress administrators should update Elementor Pro immediately through the WordPress dashboard or via command line using WP-CLI. Site owners unable to update immediately should disable the Forms module or restrict access to forms through Web Application Firewalls implementing rules that detect PHP file uploads.
Security teams should audit their web server logs for suspicious form submissions, checking access patterns to recently modified files in upload directories. Intrusion Detection Systems tuned for PHP execution in upload folders provide additional visibility.
The disclosure underscores persistent risks in the WordPress ecosystem. Plugin vulnerabilities affect thousands of sites simultaneously, creating targets of opportunity for automated attackers. Defenders require rapid patch deployment capabilities and continuous monitoring of plugin security advisories through sources like WordPress.org security repositories and trusted vulnerability databases.