A critical vulnerability (CVE-2026-32475, CVSS 9.0) in Elementor Pro's Forms module lets unauthenticated attackers upload arbitrary PHP files and achieve remote code execution on WordPress sites. The flaw stems from a file upload logic bug where extension validation and file-move steps run in separate loops, allowing an attacker to bypass the blocklist by submitting two file parts for a single File Upload field. Affected versions run up to 4.2.1; a fix shipped in 4.2.2 on August 19, 2026. A related WordPress core CVE-2026-65640 (CVSS 8.8, fixed in 7.0.4) also enables RCE via malicious PostScript uploads when Imagick and Ghostscript are in use, requiring Author-level access. No public PoC or active exploitation has been confirmed yet, but immediate patching and directory audits are recommended.
Table of contents
Executive SummaryAbout CVE-2026-32475Affected SystemsRisk ImpactRemediationHow Orca Can HelpQuestions this post answers
What is CVE-2026-32475 and how does it affect Elementor Pro?
CVE-2026-32475 is a critical (CVSS 9.0) unauthenticated remote code execution vulnerability in the Elementor Pro WordPress plugin's Forms module, affecting versions up to and including 4.2.1. Attackers exploit inconsistent handling of empty file entries between the extension validation loop and the file-move loop by submitting two file parts for one File Upload field, bypassing the extension blocklist and writing a PHP file to a publicly accessible uploads directory. Teams patching WordPress plugin vulnerabilities can track fixes like this one on daily.dev.
How do I fix CVE-2026-32475 in Elementor Pro?
Upgrade Elementor Pro to version 4.2.2 or later, released August 19, 2026, which patches the file upload flaw. Also audit the wp-content/uploads/elementor/forms/ directory for unexpected PHP files, review forms exposing File Upload fields, and consider WAF rules blocking PHP uploads through form endpoints as an interim mitigation while patching. daily.dev helps developers stay on top of plugin patches like this Elementor Pro fix.
What is CVE-2026-65640 in WordPress core and how is it related to the Elementor Pro flaw?
CVE-2026-65640 is a separate WordPress core vulnerability (CVSS 8.8, fixed in version 7.0.4) that allows an Author-level user or higher to achieve remote code execution via a malicious PostScript upload, exploiting a flaw in Ghostscript's handling of embedded files when both Imagick and Ghostscript are in use. It affects WordPress core versions 4.7 through 7.0 and is unrelated in root cause to the Elementor Pro Forms module issue, but both should be patched together. Developers tracking multiple concurrent WordPress CVEs can follow both fixes via daily.dev.