Critical Elementor Pro File‑Upload Flaw (CVE‑2026‑32475) Enables Remote Code Execution on WordPress Sites
What It Is — A critical remote‑code‑execution vulnerability (CVE‑2026‑32475) in Elementor Pro ≤ 4.2.1 lets an attacker bypass the plugin’s file‑upload validation, drop a malicious PHP web‑shell, and execute arbitrary commands on the underlying server.
Exploitability — Actively exploited since the public patch on 19 Aug 2026; Wordfence blocked ~190 k attempts in the first week. No public CVSS, but the combination of remote exploitation and full‑system compromise rates it as Critical.
Affected Products — Elementor Pro plugin for WordPress (versions 4.2.1 and earlier). The flaw is triggered when a site publishes an Elementor Form widget that includes a File Upload field.
Why It Matters for Trust & Control Assurance
- Vulnerability‑management evidence – Continuous proof that patches are applied (version inventory, signed patch logs) is now a required audit artifact across frameworks (e.g., NIST CSF 2.0).
- Secure configuration monitoring – The upload directory must be locked down and file‑type controls enforced; this maps to the “Secure Configuration” control objective that satisfies many standards simultaneously.
- Defensible remediation proof – Retaining WAF block logs and forensic scan results provides the defensible evidence enterprise buyers demand during security‑review negotiations.
Recommended Actions
- Upgrade every Elementor Pro installation to 4.2.2 or later without delay.
- Scan the
/wp-content/uploads/elementor/forms/folder for rogue.phpfiles; quarantine or delete any findings. - Deploy a Web Application Firewall rule that blocks the known empty‑array upload pattern and retain the block logs as control evidence.
- Integrate plugin‑version checks into your continuous asset‑inventory pipeline and map the remediation to the Vulnerability Management control objective in your framework of record.
Source: BleepingComputer