---
id: 7522
title: "CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC"
cve: CVE-2026-32475
cvss: 9.8
severity: critical
vendor: "Elementor"
product: "Elementor Pro"
affected_versions: "<= 4.2.1"
source_domain: github.com
source_url: "https://github.com/dinosn/cve-2026-32475-elementor-pro-lab"
published_at: "2026-09-05T06:23:21Z"
tags: ["bug-bounty", "rce", "wordpress", "red-team", "poc", "file-upload", "cve-2026-32475", "elementor"]
phying_url: "https://phying.com/item/7522"
lang: en
---

# CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC

## Summary

A Docker lab and PoC for CVE-2026-32475: an unauthenticated file-upload flaw in Elementor Pro Forms (≤4.2.1) where a loop desync bypasses extension blocklists, plus uniqid() filename recovery for RCE.

## Why it matters

Highlights a critical loop desync vulnerability in form upload processing, demonstrating how multipart handling flaws can bypass extension blocklists and achieve unauthenticated RCE on WordPress targets.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-32475
- **CVSS:** 9.8
- **Vendor:** Elementor
- **Product:** Elementor Pro
- **Affected versions:** <= 4.2.1
- **Published:** 2026-09-05T06:23:21Z
- **Original:** https://github.com/dinosn/cve-2026-32475-elementor-pro-lab
- **Phying News:** https://phying.com/item/7522