CVE-2026-32475: Elementor Pro Unauthenticated File Upload to RCE — Detection and Remediation Guide

WordPress site operators running Elementor Pro need to treat this as a drop-everything patch event. Researchers have disclosed CVE-2026-32475, a critical vulnerability in the Elementor Pro plugin with a CVSS score of 9.0 that allows unauthenticated attackers to upload files of a dangerous type — including PHP — and achieve remote code execution on the underlying web server.

The flaw resides in the Forms module's File upload field, one of the most commonly deployed features of the plugin. Any site that publishes an Elementor Pro form with a file upload field — contact forms, job application forms, quote request forms — is potentially exposed to anonymous internet users uploading executable server-side code. Given Elementor Pro's install base in the millions and the low barrier to exploitation (no authentication, no user interaction), this vulnerability sits squarely in mass-exploitation territory. Historically, critical unauthenticated file upload flaws in popular WordPress plugins move from disclosure to weaponization by botnets within days, sometimes hours.

This post breaks down the vulnerability from a defender's perspective and delivers the detection logic, hunting queries, and remediation steps your team needs now.

Technical Analysis

Affected Product and Component

• Product: Elementor Pro (the commercial extension to the Elementor page builder for WordPress)
• Affected component: Forms module — specifically the File upload field handling logic
• CVE: CVE-2026-32475
• CVSS: 9.0 (Critical)
• Vulnerability class: CWE-434 — Unrestricted Upload of File with Dangerous Type
• Attack requirements: Unauthenticated, remote, low complexity. The attacker only needs to reach a published Elementor Pro form that includes a file upload field.

How the Vulnerability Works

Elementor Pro's Forms module lets site builders add a file upload field to front-end forms. Under normal operation, the plugin validates uploaded files against an allowlist of permitted extensions/MIME types and stores accepted files under the WordPress uploads directory (typically wp-content/uploads/...).

The root cause of CVE-2026-32475 is a failure in that validation pipeline: the file-type checks can be bypassed (or are absent under certain configurations), allowing a crafted multipart form submission to the form's AJAX endpoint (/wp-admin/admin-ajax.php with the Elementor forms action, e.g. action=elementor_pro_forms_send_form) to write an arbitrary file — including .php, .phtml, or double-extension variants like shell.php.jpg — to a web-accessible location.

The exploitation chain from a defensive standpoint:

1. Reconnaissance: Attacker identifies WordPress sites running Elementor Pro with forms containing file upload fields (trivially enumerable via page source and form markup).
2. Weaponized upload: Attacker POSTs a crafted multipart request to admin-ajax.php carrying the Elementor form action with a PHP payload as the uploaded file.
3. Write to disk: The file lands in a predictable location under wp-content/uploads/ (often year/month subdirectories).
4. Execution: Attacker browses directly to the uploaded PHP file URL. The web server (PHP-FPM/mod_php) interprets and executes it — giving the attacker code execution as the web server user (www-data, apache, or the hosting account user).
5. Post-exploitation: Typical follow-on activity includes webshell installation (WSO, FilesMan, b374k variants), credential harvesting from wp-config.php (database credentials, auth keys), lateral movement into the database, SEO spam injection, and pivoting the site into a botnet or phishing infrastructure.

Exploitation Status

At the time of disclosure, technical details are public and the vulnerability class (unauthenticated unrestricted file upload in a mass-deployed plugin) is one that threat actors operationalize extremely quickly. Defenders should assume active scanning and exploitation attempts are imminent or already underway and treat any internet-facing WordPress site running Elementor Pro as a priority patching target. Check CISA's Known Exploited Vulnerabilities catalog and the vendor advisory for updates on confirmed in-the-wild exploitation and any federal remediation deadlines.

Detection & Response

This is a technical threat. The detection strategy below focuses on the three most reliable observables: (1) POST requests to the Elementor forms AJAX action carrying suspicious file content, (2) PHP files written into the WordPress uploads directory, and (3) the web server process spawning unexpected child processes — the signature of webshell execution.

Sigma Rules

---
title: PHP File Written to WordPress Uploads Directory
id: 3b7c2a91-4e5d-4f8a-9c1b-2d3e4f5a6b7c
status: experimental
description: Detects PHP or other executable file types written under wp-content/uploads, consistent with webshell deployment via unrestricted file upload flaws such as CVE-2026-32475 in Elementor Pro.
references:
  - https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains: '/wp-content/uploads/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.inc'
  condition: selection_path and selection_ext
falsepositives:
  - Rare legitimate plugin/theme functionality that generates PHP in uploads; virtually none should
level: high
---
title: Web Server Process Spawning Shell or System Utilities
id: 8f2d4e6a-1b3c-4d5e-9f7a-0b1c2d3e4f5a
status: experimental
description: Detects web server or PHP-FPM worker processes spawning shells or system utilities, a strong indicator of webshell execution following exploitation of a WordPress file upload vulnerability such as CVE-2026-32475.
references:
  - https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'php-fpm'
      - 'apache2'
      - 'httpd'
      - 'nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate backup or maintenance plugins invoking system tools; rare on production web servers
level: critical

KQL (Microsoft Sentinel / Defender)

The following query hunts inbound requests to the Elementor forms AJAX action and subsequent access to PHP files under the uploads path. It assumes web server access logs are ingested via Syslog/CEF or a custom log table; adjust the table and field names to your ingestion pipeline.

// Hunt for Elementor Pro form submissions and access to PHP files in uploads
union isfuzzy=true
  (Syslog
   | where SyslogMessage has_any ("admin-ajax.php", "elementor_pro_forms_send_form", "elementor_pro/forms")
   | extend RawEvent = SyslogMessage),
  (CommonSecurityLog
   | where RequestURL has_any ("admin-ajax.php", "wp-content/uploads")
   | where RequestMethod == "POST" or RequestURL has ".php"
   | extend RawEvent = RequestURL)
| where RawEvent has "admin-ajax.php" and RawEvent has "elementor"
    or (RawEvent has "wp-content/uploads" and RawEvent has_any (".php", ".phtml", ".phar"))
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, SourceIP = coalesce(SourceIP, SourceHostName), RawEvent
| order by LastSeen desc

For endpoint hunting on the web server itself via Defender for Endpoint (Linux hosts onboarded to MDE):

// Webshell execution: web server spawning unexpected child processes
DeviceProcessEvents
| where InitiatingProcessFileName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "whoami", "id")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt artifact to sweep WordPress servers for PHP webshells planted in the uploads directory, the primary post-exploitation artifact of CVE-2026-32475.

-- Hunt for PHP/executable files planted in WordPress uploads directories
-- consistent with unrestricted file upload exploitation (CVE-2026-32475)
LET upload_roots = SELECT FullPath
FROM glob(globs='/var/www/**/wp-content/uploads')

SELECT FullPath,
       Size,
       Mtime AS ModifiedTime,
       Ctime AS CreatedTime,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.{php,phtml,php3,php4,php5,php7,phar,inc}')
ORDER BY ModifiedTime DESC

A companion artifact to identify processes spawned by the web server user — the runtime signature of an active webshell:

-- Identify shells and download tools running as the web server user
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Username =~ '(www-data|apache|nginx|nobody)'
  AND (Name =~ '(sh|bash|dash|curl|wget|nc|ncat|python|perl)'
       OR CommandLine =~ '(curl |wget |/tmp/|base64|nc -|/dev/tcp/)')

Remediation

1. Patch Immediately

Update Elementor Pro to the latest version released by the vendor containing the fix for CVE-2026-32475. Apply the update through the WordPress admin dashboard (Dashboard → Updates) or via WP-CLI. Reference the official sources:

• Elementor changelog and security advisories: https://elementor.com/help/
• Wordfence / WPScan vulnerability entry for CVE-2026-32475 for the exact fixed version number
• The Hacker News disclosure: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html

Do not rely on a WAF rule as a substitute for patching. Virtual patching is a bridge control, not a fix.

2. Verify and Harden

Run the following on each WordPress host to confirm the plugin version, audit the uploads tree for planted PHP, and verify an .htaccess/nginx block prevents PHP execution in uploads:

#!/bin/bash
# CVE-2026-32475 verification and hardening script — run as root or via sudo on WordPress hosts
WP_PATH="/var/www/html"   # adjust per site

# 1. Report installed Elementor Pro version
if command -v wp &>/dev/null; then
  wp plugin list --path="$WP_PATH" --format=table | grep -i elementor
else
  grep -i "Version" "$WP_PATH/wp-content/plugins/elementor-pro/elementor-pro.php" 2>/dev/null
fi

# 2. Hunt for PHP/executable files planted in uploads (potential webshells)
echo "[+] Scanning uploads for PHP files..."
find "$WP_PATH/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.php[0-9]" \) -printf "%T@ %Tc %p\n" | sort -rn | head -50

# 3. Check for double-extension bypass artifacts
echo "[+] Checking for double-extension files..."
find "$WP_PATH/wp-content/uploads" -type f -name "*.php.*" -ls

# 4. Verify PHP execution is blocked in uploads (Apache)
HTACCESS="$WP_PATH/wp-content/uploads/.htaccess"
if [ ! -f "$HTACCESS" ]; then
  echo "[+] Creating .htaccess to deny PHP execution in uploads"
  printf 'php_flag engine off\n<FilesMatch "\\.(php|phtml|phar|php[0-9])$">\n  Require all denied\n</FilesMatch>\n' > "$HTACCESS"
fi

# 5. Review recent form-submission traffic for exploitation attempts
echo "[+] Suspicious admin-ajax.php Elementor form POSTs (last 7 days):"
find /var/log -name "*access*log*" -mtime -7 -exec zgrep -h "elementor_pro_forms_send_form" {} \; 2>/dev/null | grep -Ei "\.php|\.phtml|\.phar" | tail -50

For nginx-hosted sites, add a location block denying execution of PHP under /wp-content/uploads/ and reload nginx after testing the config.

3. Compromise Assessment

Because this flaw is unauthenticated and pre-patch exposure windows are unknowable, patching alone is not sufficient. For every internet-facing site that ran a vulnerable version:

• Scan the full web root (not just uploads) for recently modified or anomalous PHP files; compare against a known-good backup or the vendor/plugin checksums (wp plugin verify-checksums, wp core verify-checksums).
• Audit WordPress users for rogue administrator accounts created post-exploitation.
• Rotate all credentials in wp-config.php (database password, auth keys/salts) and any API keys stored in the database.
• Review outbound connections from the web server for C2 or spam-relay activity.
• If any webshell or unauthorized artifact is found, treat it as a full incident: isolate the host, preserve forensic images, and follow your IR playbook before rebuilding from a known-good state.

4. Compensating Controls

• Deploy or tune WAF rules to block multipart POST bodies containing PHP content targeting admin-ajax.php with the Elementor forms action.
• Ensure PHP execution is disabled in all upload directories at the web server layer — this single hardening step neutralizes most file-upload-to-RCE chains even when the application-layer validation fails.
• Restrict the web server user's permissions: no shell, read-only where possible, and egress filtering on outbound connections from web servers.

5. Ongoing Monitoring

Deploy the Sigma rules and VQL hunts above into your SIEM and DFIR tooling, and schedule recurring webshell sweeps across all WordPress estates. Plugin vulnerabilities of this class are a recurring pattern in the WordPress ecosystem — the detections built for CVE-2026-32475 will remain valuable against the next one.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub