Full research report

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-32475 is a well-evidenced critical flaw arising from a subtle loop desynchronisation in Elementor Pro's Forms module, where differing early-exit logic between the file-extension validator and the file-mover allows an unauthenticated attacker to write an arbitrary PHP file into a publicly reachable directory on any site hosting a standard File Upload form—an extremely prevalent configuration across job applications, support tickets, and media-submission workflows. The patch (v4.2.2) was released after a coordinated 34-day disclosure process and should be applied immediately given the breadth of exposure. CVE-2026-65640 is a narrower authenticated flaw, but its decade-long affected range (WordPress 4.7–7.0.3) and the relative accessibility of Author-level accounts on multi-user sites make it a credible risk for platforms with loosely managed contributor roles; WordPress's backport of the fix to all affected branches reduces remediation complexity. No confirmed in-the-wild exploitation of either CVE has been documented, though CVE-2026-32475's unauthenticated nature, the prevalence of the required form configuration, and the technical detail available in Patchstack's public advisory collectively make post-disclosure weaponisation plausible in the short term. The StopAndProtect campaign represents an active, large-scale threat against the WordPress ecosystem but is connected to these CVEs only by editorial proximity, not by any published causal evidence.

What happened

On 20 August 2026, Patchstack publicly disclosed CVE-2026-32475, a CVSS 9.0 unauthenticated arbitrary file upload vulnerability in Elementor Pro discovered by researcher Tin Pham (TF1T) and reported on 16 July 2026; the vendor released patch version 4.2.2 on 19 August after a coordinated 34-day process. Separately, WordPress released version 7.0.4 on approximately 13 August 2026 to address CVE-2026-65640 (CVSS 8.8), an authenticated remote code execution flaw in WordPress core affecting versions 4.7 through 7.0.3 via malicious PostScript file processing through Imagick and Ghostscript. The article also references the unrelated StopAndProtect campaign—a large-scale operation using roughly 2,000 compromised WordPress sites as command-and-control and malware delivery infrastructure—as broader context, not as a cause or consequence of either CVE.

Affected scope

CVE-2026-32475 affects Elementor Pro (active on over 10 million WordPress installations) versions 4.2.1 and below wherever a published page contains a Form widget with a File Upload field, which is described as an extremely common default configuration. CVE-2026-65640 affects WordPress core versions 4.7 through 7.0.3 across 21 release branches on servers running both Imagick and Ghostscript; the WordPress security team issued backported patches for every affected branch down to 4.7.35, and the attack additionally requires an attacker to hold an Author-level account or possess the upload_files capability.

Technical assessment

CVE-2026-32475 exploits a loop desynchronisation within Elementor Pro's Forms module: the code that validates uploaded file extensions and the code that moves uploaded files to the server iterate through the same multipart submission using different early-exit logic for empty file entries. The validator's return path abandons iteration on an empty entry, skipping extension checks for any subsequent file parts; the processor's continue path skips only the empty entry and proceeds to move the remaining parts—including a PHP file—into the publicly accessible wp-content/uploads/elementor/forms/ directory. The resulting filename incorporates PHP's uniqid() output, which could be narrowed through timing-based brute force or exposed via form autoresponder emails. CVE-2026-65640 arises at the WordPress–ImageMagick integration boundary: a crafted media file is passed to Ghostscript for processing, enabling server-side code execution; the fix alters how WordPress validates file contents before dispatch to ImageMagick.

Recommended defensive actions

  1. Update Elementor Pro to version 4.2.2 or later immediately and verify the active version via the WordPress Plugins admin page.
  2. Update WordPress core to version 7.0.4 or the latest patched branch release (e.g., 6.9.7, 6.8.8, down to 4.7.35) to remediate CVE-2026-65640.
  3. Audit wp-content/uploads/elementor/forms/ for any unexpected PHP files and remove them; review associated access logs for evidence of web shell activity.
  4. Disable Imagick and Ghostscript on servers where media processing does not operationally require them, eliminating the attack surface for CVE-2026-65640.
  5. Monitor WordPress sites for anomalous outbound connections, unauthorised account creation, and unexpected plugin installation consistent with StopAndProtect infrastructure abuse.

Uncertainties and evidence gaps

  • Exploitation status of CVE-2026-32475 is contradictory between sources: the Patchstack database entry uses language indicating active exploitation while BleepingComputer's contemporaneous report explicitly states no in-the-wild exploitation has been observed; no incident-backed claim has been published by either.
  • No public proof-of-concept code for CVE-2026-32475 has been identified, but the Patchstack advisory describes the loop desynchronisation mechanism in sufficient detail to enable independent reproduction, which may accelerate weaponisation after disclosure.
  • The true exposure count for CVE-2026-32475 cannot be estimated precisely, as the over-10-million Elementor Pro install figure does not indicate how many sites expose a File Upload form field in a published form.
  • No published evidence establishes a causal link between the StopAndProtect campaign and either CVE; the article co-references them as parallel WordPress risks without asserting connection.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessCVE-2026-32475: unauthenticated, network-accessible attacker; only prerequisite is a reachable WordPress page hosting a published Elementor Pro form with a File Upload field. CVE-2026-65640: authenticated attacker with Author-level privileges or the upload_files capability on a server running both Imagick and Ghostscript.
ComponentCVE-2026-32475: Elementor Pro Forms module File Upload field and associated file-handling routines. CVE-2026-65640: WordPress core media upload research process and its ImageMagick/Ghostscript integration layer.
MechanismCVE-2026-32475: a multipart upload with a crafted empty file entry causes the extension-validation loop and the file-move loop to process the submission differently, resulting in a PHP file bypassing the extension blocklist and being written to a public directory. CVE-2026-65640: a crafted file uploaded as media is interpreted as PostScript by Ghostscript when processed through ImageMagick, enabling code execution in the web server's security context.
ImpactAttacker gains arbitrary server-side code execution, enabling data exfiltration, persistent backdoor installation, content modification, and potential lateral movement to co-hosted services.
DetectionCVE-2026-32475: unexpected PHP files under wp-content/uploads/elementor/forms/; web server access log requests to that path followed by PHP execution events. CVE-2026-65640: media upload log entries for PostScript or ambiguously-typed files from Author-level accounts; anomalous process spawning from the web server user.
MitigationCVE-2026-32475: upgrade Elementor Pro to 4.2.2 or later. CVE-2026-65640: upgrade WordPress core to 7.0.4 or the latest patched branch version; additionally, disable Ghostscript if not operationally required.
Exploitation status

No confirmed active in-the-wild exploitation of either CVE as of 20 August 2026; a Patchstack database entry uses language suggesting expected mass-targeting for CVE-2026-32475, but this is directly contradicted by BleepingComputer's contemporaneous report explicitly stating no in-the-wild exploitation has been observed.

Research process

The investigation began with the THN article as the sole supplied source, identifying two CVEs and a campaign reference requiring independent verification. The Patchstack advisory was confirmed as the authoritative technical source for CVE-2026-32475, with BleepingComputer providing independent domain corroboration and resolving a contradiction in exploitation status introduced by Patchstack's database entry. The CUHK institutional advisory provided independent confirmation of CVE-2026-65640 scope and patch branches. A search for StopAndProtect confirmed the campaign is well-documented by multiple outlets but established no published causal link to either CVE.

  1. What does the primary supplied article report and does it reference primary advisory URLs for independent verification?
    Fetched The Hacker News article to extract factual claims and source URLs
    thehackernews.com ↗

    Confirmed CVE-2026-32475 (CVSS 9.0) in Elementor Pro ≤ 4.2.1 patched in 4.2.2; CVE-2026-65640 (CVSS 8.8) in WordPress core patched in 7.0.4; Patchstack advisory URL identified as the primary technical source to verify.

    why Established the event frame and extracted URLs for primary source verification, treating article claims as unverified leads rather than confirmed facts.

  2. Does the Patchstack advisory confirm the mechanism, preconditions, timeline, and exploitation status for CVE-2026-32475?
    Fetched Patchstack advisory article
    patchstack.com ↗

    Confirmed loop desynchronisation mechanism in full technical detail; reported date 16 July 2026; patch released 19 August; filename recoverable via timing or autoresponder email; advisory text does not claim active exploitation.

    why Primary technical authority from the discovering organisation; confirmed the article's claims and added the filename-recovery attack path as a defensive consideration.

  3. Does the Patchstack vulnerability database record corroborate the structured vulnerability details?
    Fetched Patchstack database record for CVE-2026-32475
    patchstack.com ↗

    Confirmed CVSS 9.0, affected versions ≤ 4.2.1, fixed in 4.2.2, researcher Tin Pham (TF1T). The record uses boilerplate language stating the flaw 'has been documented as actively exploited in the wild', which is not backed by a cited incident.

    why Identified the source of an exploitation-status contradiction that required resolution by consulting a second independent domain.

  4. Does an independent second domain corroborate the CVE-2026-32475 details and can it resolve the exploitation-status contradiction?
    Fetched BleepingComputer article on CVE-2026-32475
    bleepingcomputer.com ↗

    Corroborated all key technical facts; explicitly states 'no cases of active exploitation have been observed in the wild', directly contradicting the Patchstack database boilerplate.

    why BleepingComputer's specific, incident-grounded statement outweighs an uncited boilerplate claim in a database entry; resolved the exploitation contradiction in favour of no confirmed exploitation.

  5. What is the confirmed scope, affected version range, required conditions, and patch status for CVE-2026-65640?
    Fetched CUHK ITSC institutional advisory for CVE-2026-65640
    itsc.cuhk.edu.hk ↗

    Confirmed 21 affected branch ranges from WordPress 4.7.0–7.0.3; patched in 7.0.4 and backported to 4.7.35; requires Imagick, Ghostscript, and Author-level account; no in-the-wild exploitation stated.

    why Provided a second independent domain for the WordPress core CVE, confirming scope, conditions, and mitigation without relying on the untrusted article text.

  6. Is StopAndProtect a documented real-world campaign and is it linked by published evidence to either CVE?
    Searched for StopAndProtect campaign reporting across multiple outlets

    Confirmed as a documented campaign reported by multiple outlets including Check Point Research, CyberSecurityNews, and Security Affairs; approximately 2,000 compromised WordPress sites used as C2 and malware distribution; SilentEncryptor ransomware and credential stealers deployed via ClickFix lures. No published source links StopAndProtect to CVE-2026-32475 or CVE-2026-65640.

    why Established the campaign is real and substantive, but confirmed it is a co-mentioned context item in the article rather than a causal element of this CVE story; flagged as a material uncertainty.

Named in this story
ActorsStopAndProtect (campaign operators, contextually referenced)
MalwareSilentEncryptor (associated with StopAndProtect, not these CVEs directly)
TargetsWordPress sites running Elementor Pro with a published form containing a File Upload fieldWordPress core installations (4.7–7.0.3) running both Imagick and Ghostscript with Author-level accountsMulti-author publications, membership sites, and sites with open or loosely managed user registration
Related CVEs CVE-2026-32475CVE-2026-65640

Research coverage

All 68 registered source leaves were evaluated for this run: 55 completed, 0 were unavailable, 6 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 53 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok16 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok8 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1673 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok686 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: exploitresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: penetration-testingresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: pocresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: vulnerabilityresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Technical references1
github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

Vendor & gov advisories3
Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin – Patchstack patchstack.com ↗

Primary technical advisory for CVE-2026-32475; confirms loop desynchronisation mechanism, full disclosure timeline, and preconditions.

WordPress Elementor Pro Plugin ≤ 4.2.1 – Arbitrary File Upload – Patchstack Database patchstack.com ↗

Structured vulnerability record confirming CVSS 9.0, affected range, fixed version, and researcher credit for CVE-2026-32475.

WordPress Remote Code Execution Vulnerability (CVE-2026-65640) – CUHK ITSC itsc.cuhk.edu.hk ↗

Institutional advisory confirming scope across 21 WordPress branch versions from 4.7 to 7.0.3 and all patched sub-versions.

Analysis & research1
Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks – BleepingComputer bleepingcomputer.com ↗

Independent corroboration of CVE-2026-32475 details; the only source to explicitly state no in-the-wild exploitation observed.