Two loops, one blocklist bypass: Elementor Pro's upload field becomes unauthenticated RCE

Patchstack has disclosed CVE-2026-32475, a critical flaw in the Elementor Pro WordPress plugin rated 9.0 out of 10.0 on CVSS and classed as unrestricted upload of a file with a dangerous type ^[3]. Every version up to and including 4.2.1 is affected, and the fix landed in 4.2.2 on August 19 after the report went to Elementor on July 16, 2026 ^[4][5].

The mechanism is a validation-and-action split, not a missing check. According to Patchstack, the extension check and the file-move step in the Forms module's File Upload field run in two separate loops that handle empty file entries differently ^[1]. "By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory," the company said ^[2]. The write lands at wp-content/uploads/elementor/forms/ under a name produced by PHP's uniqid() function, with a .php extension ^[6]. No login, no privilege, no user interaction on the victim side.

The precondition is the part that should decide your patch window. Patchstack says the only requirement is that the site has at least one published Elementor page with a Form widget containing a File Upload field ^[15]. It called that "an extremely common, everyday configuration," citing job-application forms, attach-a-photo/ID/receipt forms and support-ticket attachments, and noted that the field's "Required" toggle defaults to off, so no hardened or unusual setting is needed ^[16]. The source material does not put a number on installs, so treat exposure as a question about your own page inventory rather than a headline figure: if marketing shipped a careers form, you are in scope. Tin Pham, also known as TF1T, is credited with the find under the Patchstack Bug Bounty Program ^[8].

It arrives on top of a core-level problem. A little over a week earlier ^[13], WordPress shipped 7.0.4 for CVE-2026-65640, CVSS 8.8, remote code execution via a malicious Postscript file uploaded by an Author-level user or higher, affecting core 4.7 through 7.0 ^[9]. That one needs two things to be true: Imagick and Ghostscript in use on the server, and an attacker holding the upload_files capability ^[10]. Patchstack says the update changes how WordPress hands uploaded media to ImageMagick and closes the path from an ordinary-looking image upload to code execution ^[11], and argues the privilege bar is low on multi-author publications, membership sites and client sites with contributors or loose registration ^[12].

Thirty-four days passed between report and patch on the Elementor issue ^[14], which is the window in which someone else could have found the same two loops.

What to watch: whether exploitation shows up against the uploads/elementor/forms path, and whether either bug feeds StopAndProtect, the operation Patchstack ties to thousands of compromised WordPress sites repurposed for malware delivery, command-and-control and storage of stolen data ^[17]. The stated hygiene remains unglamorous: patch, scan for unauthorised modifications serving unexpected redirects or pop-ups, and audit for unknown accounts and plugins ^[7].