Reported by 3 outlets

Timeline

1. original reporting

   Critical Elementor Pro bug exposes WordPress sites to RCE attacks

   bleepingcomputer.com · 54d ago · August 20th, 2026

   A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently. “The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack , a cybersecurity company focused on the WordPress ecosystem. “The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.” An attacker could exploit this behavior by crafting a multipart upload in which the first entry has an empty filename, followed by a malicious PHP payload. This causes the validation routine to exit after examining the first part, dismissing it with the UPLOAD_ERR_NO_FILE error and never checking the second part. The processing step skips the empty entry but goes through the rest of the upload and moves to a public directory (wp-content/uploads/elementor/forms/) the PHP in the second part. Elementor Pro is the paid version of Elementor, a highly popular drag-and-drop website builder for WordPress that has more than 10 million act

2. update from bleepingcomputer.com

   Critical Elementor Pro flaw exploited to take over WordPress sites

   bleepingcomputer.com · 40d ago · September 3rd, 2026

   A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. Elementor Pro is a popular WordPress plugin with more than 6 million active installations, allowing users to build websites using a drag-and-drop interface. Since then, Defiant's Wordfence web application firewall has blocked almost 200,000 exploitation attempts targeting its clients. The issue stems from faulty validation of file-upload arrays in Elementor Pro forms and is present in versions 4.2.1 and earlier. By submitting an empty file as the first array element and a malicious PHP file as the second, attackers can cause the plugin to stop validating subsequent files. The uploaded payload is stored under /wp-content/uploads/elementor/forms/ and can then be accessed to execute commands remotely. Exploitation is only possible when a site has a published Elementor Pro Form widget containing at least one File Upload field, a common configuration. Yesterday, Wordfence alerted that activity exploiting CVE-2026-32475 started on August 19, the same day Elementor released version 4.2.2 that addressed the vulnerability. “The attacker submits the form’s

3. update from securityweek.com

   Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

   securityweek.com · 38d ago · September 5th, 2026

   Hackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns. Elementor Pro is the paid version that offers additional features, including a Form widget with support for File Upload fields. The bug, tracked as CVE-2026-32475 (CVSS score of 9.8), is described as an arbitrary file upload issue in the function that handles form submissions. While submissions are passed through the plugin’s validation and processing mechanisms, when the validation loop encounters an upload slot marked as empty, it triggers an error and returns, aborting the validation of other files in the field. The normal behavior would be to continue, skipping the empty entry, but the vulnerability results in checks never being applied to the remaining files uploaded through the same form field. Because the function that handles field processing correctly skips the empty slot and processes the second, unvalidated part of the field, the attacker-supplied file is written to disk. “As a result, an unauthenticated attacker can request the uploaded file to execute their PHP payload on the serv

4. update from gbhackers.com

   Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability

   gbhackers.com · 25d ago · September 18th, 2026

   More than 100,000 WordPress sites using the Tutor LMS e-learning plugin were exposed to a high-severity remote code execution vulnerability that could allow low-privileged users to take control of vulnerable servers. The vulnerability was discovered on August 23, 2026, by Wordfence Argus, an AI-assisted vulnerability research agent, and validated by the Wordfence Threat Intelligence team. […] The post Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .