Critical Elementor Pro Vulnerability (CVE‑2026‑32475) Enables Remote Code Execution via File Upload
What Happened – A newly disclosed vulnerability (CVE‑2026‑32475) in Elementor Pro < 4.2.2 allows an attacker to upload a malicious PHP file through the plugin’s Form → File Upload field. The flaw stems from mismatched validation and processing loops that treat an empty‑filename part differently, letting the malicious payload bypass the validator and be written to a publicly accessible directory, where it can be executed with web‑server privileges.
Why It Matters for Compliance & Audit Readiness
- The scenario is a textbook example of a control gap that SOC 2 Security and Availability criteria require you to detect, remediate, and retain evidence for.
- Continuous control monitoring (e.g., automated plugin version checks, file‑upload hardening) provides audit‑ready proof that you’re actively managing third‑party component risk.
- Mapping this vulnerability to the “Change Management” and “System Operations” controls in your Trust Services Criteria helps you demonstrate due diligence during a SOC 2 audit.
Who Is Affected – Any organization that runs WordPress sites with the Elementor Pro plugin (estimated >10 million active installations), spanning SaaS providers, e‑commerce platforms, marketing agencies, and internal corporate sites.
Recommended Actions
- Verify your Elementor Pro version; upgrade immediately to 4.2.2 or later.
- Implement a file‑upload hardening rule (e.g., allow only whitelisted MIME types, store uploads outside the web root).
- Add the plugin version to your continuous asset inventory and enable automated alerts for future security releases.
- Document the remediation steps and retain logs as evidence for SOC 2 control testing.
Source: BleepingComputer
Technical Notes – The vulnerability is a logic error in the File Upload module’s validation vs. processing loops. An attacker crafts a multipart request where the first part has an empty filename, causing the validator to exit early while the processor moves the second part (the malicious PHP) to wp‑content/uploads/elementor/forms/. The file name is generated with uniqid(), making it predictable via timing attacks. Once accessed, the PHP payload runs with the web‑server’s user privileges.