Skip to content

Elementor Pro CVE-2026-32475 unauthenticated RCE and WordPress 7.0.4 CVE-2026-65640

Summary

Two closely-timed WordPress-ecosystem RCE flaws were disclosed in the Aug 18–20, 2026 window:

  • Elementor Pro — CVE-2026-32475 (CVSS 9.0): an unauthenticated remote-code-execution flaw in the Forms module's File Upload field. Patchstack describes it as "unrestricted upload of a file with a dangerous type." A patch (4.2.2) shipped August 19, 2026, affecting all versions through and including 4.2.1.
  • WordPress core — CVE-2026-65640 (CVSS 8.8): a high-severity RCE in how WordPress hands uploaded media to ImageMagick, reachable by a user with Author-level privilege or higher. Fixed in WordPress 7.0.4, released August 12, 2026 (a security-only release; WordPress.org recommends immediate update).

The Elementor Pro flaw is the higher-severity, lower-friction target: no authentication, and the affected widget (a Form with a File Upload field) is a "very common, everyday configuration" (job applications, photo/ID/receipt attachments, support-ticket uploads). Both ship in one of the most widely deployed CMS stacks on the internet, so expect scanner-driven mass exploitation attempts even where public in-the-wild confirmation is still thin.

Tags

Why this matters

  • Elementor Pro is one of the most-installed commercial WordPress page builders. Its Forms widget with a File Upload field is ubiquitous — job applications, "attach a photo/ID/receipt," support tickets — so the attack surface is broad and the default settings are vulnerable (the field's "Required" toggle being off is the default state).
  • Unauthenticated + network-reachable = mass-exploitation profile. An attacker needs only one public Elementor page containing a Form widget with a File Upload field; no account or MFA is involved.
  • WordPress core 7.0.4 is a forced-update-style security release. Author-level users can turn an ordinary image upload into code execution by changing how WordPress hands uploaded media to ImageMagick; even sites that are not Elementor Pro targets should apply it immediately.
  • No public in-the-wild exploitation is confirmed yet in the reporting surveyed for this page; treat this as a "patch now, then hunt" item, not a confirmed-breach item. The Elementor Pro patch shipped only a day after the WP 7.0.4 security release, so the two are often bundled into the same emergency response ticket.

Elementor Pro — CVE-2026-32475

  • Product / vendor: Elementor Pro (commercial WordPress page-builder plugin).
  • CVSS (reported): 9.0 critical.
  • Class: unrestricted upload of a file with a dangerous type / broken file-extension validation (CWE-434-family, file-upload).
  • Authentication: unauthenticated.
  • Affected versions: all Elementor Pro versions through and including 4.2.1.
  • Fixed version: 4.2.2 (released August 19, 2026).
  • Root cause (Patchstack): the File Upload field's extension check and the file-move step run in two separate loops with different handling of empty file entries. By submitting two file parts for the same field, an unauthenticated attacker skips the extension blocklist entirely and writes a PHP file into a public directory.
  • Precondition: the target site has at least one published Elementor page containing a Form widget with a File Upload field. The "Required" toggle being off is the default, so no hardened configuration is needed.
  • Upload sink: the file lands at wp-content/uploads/elementor/forms/<uniqid>.php, where <uniqid> is PHP's uniqid() output — a predictable-shape but non-deterministic path under attacker control of the payload.
  • Impact: arbitrary code execution as the PHP/WordPress user; unauthenticated.
  • Credit: Tin Pham (a.k.a. TF1T), reported July 16, 2026 under the Patchstack Bug Bounty Program.

WordPress core — CVE-2026-65640

  • Product / vendor: WordPress (core).
  • CVSS (reported): 8.8 high.
  • Class: remote code execution via malicious Postscript file upload by a user with Author-level privilege or higher.
  • Authentication: Author (or higher) account.
  • Affected versions: WordPress core versions 4.7 through 7.0 (per Patchstack, per The Hacker News coverage).
  • Fixed version: WordPress 7.0.4 (security-only release, August 12, 2026; WordPress.org recommends immediate update).
  • Root cause: the update "changes how WordPress hands your uploaded media to ImageMagick," closing a path that let a logged-in Author turn an ordinary-looking image upload into code execution on the server.
  • Impact: RCE via uploaded Postscript media by Author+ accounts; in a shared or multi-author WordPress install, any Author is a potential initial access path.
  • Note: this is a core fix, not a plugin fix — it applies across all WordPress sites on 7.0 (or 4.7+) that have not yet applied 7.0.4.

Defender priorities

  1. Apply the Elementor Pro 4.2.2 patch (CVE-2026-32475) on every WordPress site using Elementor Pro Forms with a File Upload field. This is the highest-friction reduction: unauthenticated, no account needed, broad surface.
  2. Apply WordPress 7.0.4 (CVE-2026-65640) across all WordPress installations on 7.0 or older (4.7 through 7.0). WordPress.org flags this as a security release requiring immediate update.
  3. Inventory Form widget exposure. For Elementor Pro sites, enumerate published pages containing a Form with a File Upload field; those are the attack surface. Where a patch cannot ship immediately, consider a WAF rule or file-upload extension blocklist that rejects .php / .phtml / .phps / *.*.php uploads to wp-content/uploads/elementor/forms/.
  4. Hunt for the upload sink. Look for wp-content/uploads/elementor/forms/*.php files whose names match uniqid()-style hex strings and were written shortly after the August 19, 2026 disclosure window. Inspect file contents for PHP payload, unexpected eval/assert, or obfuscated base64_decode / gzinflate / str_rot13 / base64 / pack chains.
  5. Hunt for the WP core ImageMagick path. For Author-level accounts, review uploaded media files for Postscript (*.ps / *.eps / *.ai) content that should not be present in ordinary image uploads, and review the filesystem for unexpected binaries or ImageMagick-triggered child processes around the CVE window.
  6. Rotate secrets reachable from the WordPress process if either sink is hit: database credentials, file paths, any API keys or OAuth tokens readable from the web root or from environment.
  7. Confirm no web shell persists in the elementor/forms/ directory after patching; remove and preserve any *.php files found there before re-enabling the Form.
  8. Update the WordPress install on any site that still runs < 7.0.4 — the Author-level Postscript vector does not depend on Elementor at all.

Assessment limits

  • Based on The Hacker News (Aug 20, 2026) coverage of Patchstack's Elementor Pro CVE-2026-32475 disclosure plus WordPress.org's WordPress 7.0.4 release note (Aug 12, 2026). Neither CVE had a CISA KEV entry as of this scan; no confirmed in-the-wild exploitation is documented in the surveyed reporting. Exact Elementor Pro "affected" lower bound is given as "all versions through and including 4.2.1"; the Patchstack disclosure does not name a specific older-version boundary, so treat all 4.x (and any 3.x line) as affected until the vendor states otherwise.
  • The WordPress core 4.7 through 7.0 affected-version range is per Patchstack / The Hacker News; use WordPress.org's 7.0.4 release notes as the authoritative source of which branches are patched.

Sources