Cybersecurity researchers have disclosed details of a critical vulnerability in the popular Elementor Pro WordPress plugin that could allow unauthenticated remote attackers to execute arbitrary code on target systems. Tracked as CVE-2026-32475, the flaw carries a severe CVSS score of 9.0 out of 10.0 and stems from an unrestricted file upload mechanism within the plugin’s Forms module. According to technical details provided by Patchstack, the issue arises because the extension validation blocklist and the file-move routine operate in two separate loops that handle empty file entries differently. By submitting two distinct file parts within the same upload request, an attacker can bypass the extension restrictions, writing a malicious PHP file directly into a publicly accessible web directory.
The exploit requires minimal setup to succeed, needing only a single published page with an active Form widget containing a File Upload field, even if that field is left at its default unrequired state. Because forms for job applications, customer support tickets, and receipt submissions are ubiquitous across millions of active sites, the potential attack surface is vast. When exploited, the server saves the malicious payload as a PHP script under the standard uploads pathway using PHP’s uniqid function, giving attackers full remote code execution privileges over the hosting environment. Security researcher Tin Pham discovered the defect under the Patchstack Bug Bounty Program, leading to a patch release in version 4.2.2 following disclosure to the vendor.
This revelation coincides with separate WordPress security updates addressing CVE-2026-65640, a high-severity flaw carrying a 8.8 CVSS score that enables remote code execution through malicious Postscript uploads processed via ImageMagick and Ghostscript. While that specific core bug requires an attacker to possess media upload capabilities on a site running susceptible server binaries, it presents a substantial risk to platforms with multiple authors or open user registrations. The update modifies how uploaded media passes to ImageMagick, effectively closing off paths that logged-in users with contributor status could exploit to run unauthorized software on target web servers.
Concurrently, security analysts have identified a massive campaign known as StopAndProtect, which has compromised thousands of sites to build distributed infrastructure for malware distribution, command servers, and stolen data storage. The widespread operation highlights the growing tendency of threat actors to leverage unpatched website software as persistent hubs for broader malicious operations. Web site administrators are strongly advised to update all core files and plugins immediately, audit existing site accounts for unauthorized access privileges, and scan their file systems for unexpected scripts or malicious redirect behavior.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
