This text was generated using artificial intelligence (AI).Update August 20, 2026: In addition, CVE-2026-66592 (CVSS 9.3) has been reported—an unauthenticated SQL injection vulnerability in the rtMedia for WordPress, BuddyPress, and bbPress plugin up to and including version 4.7.11. See below for details.
Update August 22, 2026: In addition, CVE-2026-78003 (CVSS 9.8) has been disclosed—a server-side request forgery (SSRF) vulnerability via path traversal in the WordPress plugin “Mailgun for WordPress” through version 2.2.0. See below for details.
For the WordPress plugin Elementor Pro On August 19, 2026, the vulnerability was CVE-2026-32475 Published. It applies to Elementor Pro through and including Version 4.2.1. Patchstack describes an unauthenticated file upload in the Forms module that allows a PHP file to be uploaded and code to be executed. The vulnerability was discovered by Tin Pham (aka TF1T) as part of the Patchstack bug bounty program.
The reported CVSS score is 9.0. In terms of content, this involves an uncontrolled upload of files of a dangerous type, i.e., the vulnerability class CWE-434. The timeline in the advisory lists July 16, 2026, as the filing date; the corrected version was published a little over a month later.
Status: No active abuse has been documented (as of August 22, 2026)
Patches available since: August 19, 2026 (Elementor Pro), August 20, 2026 (rtMedia); the patch status for Mailgun for WordPress is unknown
How to Bypass the File Upload Vulnerability (CVE-2026-32475)
According to Patchstack, the vulnerability lies in the way the Forms module processes file uploads. The validation of the file extension and the movement of the uploaded file occur in separate processing steps.
An attacker can submit two file parts for the same form field. Empty file entries are handled differently in the two processing steps. This allows the intended block list for file extensions to be bypassed. A PHP file can then be written to a public directory.
Patchstack specifies the following as the target directory wp-content/uploads/elementor/forms/. The file name is determined there by the PHP function uniqid() It is generated and consists of 13 hex characters: eight encode the Unix second of the upload, and five encode the microseconds. Patchstack documents this structure because an attacker must then specifically access the stored file in order to execute the code it contains.
Exploitation does not require authentication, provided that the affected WordPress site contains at least one publicly accessible Elementor form with the file upload field enabled—a common configuration, according to Patchstack, such as in job application or support forms. The vulnerability could therefore lead to code execution on an affected system.
Unauthenticated SQL Injection in rtMedia (CVE-2026-66592)
CVE-2026-66592 affects the WordPress plugin rtMedia for WordPress, BuddyPress, and bbPress through and including version 4.7.11. The vulnerability allows an unauthenticated attacker to inject SQL commands into the database. The CVSS score is 9.3 (critical). The attack vector is network-based and requires no authentication or user interaction.
According to the Patchstack database, the vulnerability could lead to the disclosure of confidential data from the WordPress database and, under certain circumstances, could affect the application's availability. The fixed version, 4.7.12, was released on August 20, 2026.
Server-Side Request Forgery in Mailgun for WordPress (CVE-2026-78003)
CVE-2026-78003 affects the WordPress plugin Mailgun for WordPress through and including version 2.2.0. The vulnerability allows an unauthenticated attacker to perform server-side request forgery (SSRF) via path traversal. The CVSS score is 9.8 (critical). The attack vector is network-based (AV:N), the attack complexity is low (AC:L), no authentication is required (PR:N), and no user interaction is necessary (UI:N). The impact on confidentiality, integrity, and availability is rated as high in each case (C:H/I:H/A:H).
According to Wordfence Threat Intelligence, an attacker can exploit this vulnerability to send requests to internal systems or external services that appear to originate from the affected server. This can lead to the disclosure of internal network structures, access to protected resources, or the circumvention of firewall rules. The patch status for Mailgun for WordPress is unknown at the time of this publication.
Operational Relevance: Why These Gaps Should Be Prioritized
The barriers to an attack are low for all three vulnerabilities. No credentials are required, there are no prerequisites on the user’s end, and no employee interaction is needed. For CVE-2026-32475, all that is needed is a published page with an Elementor form that contains an upload field. For CVE-2026-66592, all that is required is an installation of the rtMedia plugin. For CVE-2026-78003, installation of the Mailgun plugin is sufficient. It is precisely these configurations that can be automatically detected from the outside across many domains. Patchstack and Wordfence publicly described the exploitation methods and vulnerability details in detail on August 19, 20, and 22, respectively; experience shows that the time window between a patch being released and widespread scanning is short for such vulnerabilities.
In addition, Elementor Pro, rtMedia, and Mailgun are typically used on corporate websites, campaign landing pages, career pages, community platforms, and product microsites. These sites are often created as part of marketing projects or by external service providers and run under their own domains or subdomains without being listed in the central IT inventory. For the security team, this means that the affected software may be running on systems that aren’t even included in patch planning, and in case of doubt, responsibility for them isn’t immediately clear.
An application or support form with an upload field is not an exception here, but rather the norm on these very pages. If the upload is successful in CVE-2026-32475, the attacker can execute code in the context of the web server. In the case of CVE-2026-66592, an attacker can directly access the database. In the case of CVE-2026-78003, an attacker can scan internal network resources or access protected services. At this point, it is no longer just about a website, but about gaining access to the underlying system and the data processed there.
Update Affected Installations
Elementor Pro 4.2.2 Fixes CVE-2026-32475. rtMedia 4.7.12 Resolves CVE-2026-66592. As of this publication, there is no known patch for Mailgun for WordPress; organizations should monitor the vendor’s announcements and, if necessary, consider alternative measures—such as disabling the plugin—until an update is available. Organizations should update known installations of Elementor Pro and rtMedia to the patched versions or higher.
After the update, WordPress sites should be checked for unauthorized file uploads in Elementor forms. Of particular concern are files in the form upload fields whose origin or purpose cannot be determined. For rtMedia installations, database logs should be checked for unusual queries that could indicate a successful SQL injection. For Mailgun installations, server logs should be checked for unusual outbound requests or access to internal resources.
In addition, the following measures are recommended:
more rigorous validation of file uploads,
Monitoring of upload operations,
Checking Elementor forms for unauthorized uploads,
Monitoring database access for anomalies,
Monitoring outgoing server requests for unusual destinations,
Network segmentation to limit the scope of SSRF attacks.
Reporting Requirements in the Event of a Successful Attack
For operators of WordPress sites that involve EU citizens, the following applies: If an attack is successful and personal data is compromised as a result, there is an obligation under Article 33 of the GDPR to report the incident to the competent supervisory authority within 72 hours. Organizations in Germany and Austria that fall under NIS-2 or the Austrian NISG should also verify whether the incident triggers their reporting obligations under the respective national implementing legislation. The BSI generally recommends checking publicly accessible web applications promptly for available security updates.
EASM: Keep Exposed WordPress Instances Visible
CVE-2026-32475, CVE-2026-66592, and CVE-2026-78003 affect web applications running on their own domains and subdomains. Therefore, the first question when such reports arise is not whether the version has been patched, but where the software is actually running.
That’s exactly where External Attack Surface Management comes in. LocateRisk continuously tracks which systems and web applications are publicly accessible under a company’s own domains and which software can be detected from the outside. This also makes websites visible that are operated outside of centrally maintained inventories, and assigning them to the responsible teams becomes a matter of minutes rather than days. Our overview describes the methodical process of conducting such an inventory: Attack Surface Assessment.
Technical visibility does not replace either the update to Elementor Pro 4.2.2 or rtMedia 4.7.12, nor does it replace the review of uploads, database logs, and server requests. It answers the underlying question: Which systems should be included in the patch list, and who is responsible for taking action?.
Am I affected?
Affected versions include Elementor Pro up to 4.2.1, rtMedia up to 4.7.11, and Mailgun for WordPress up to 2.2.0; the vulnerabilities have been fixed in Elementor Pro 4.2.2 and rtMedia 4.7.12, respectively. The patch status for Mailgun for WordPress is unknown. If you want to know whether Elementor Pro, rtMedia, or Mailgun are even visible in your own externally accessible infrastructure, you can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version installed from the outside—the key factor is comparing it with the manufacturer's advisories.
CVE-2026-32475 is a critical vulnerability in the Elementor Pro WordPress plugin that allows an unauthenticated attacker to upload a PHP file to a publicly accessible directory via the Forms module and execute code there. The CVSS score is 9.0.
CVE-2026-66592 is a critical SQL injection vulnerability in the WordPress plugin rtMedia for WordPress, BuddyPress, and bbPress. It allows an unauthenticated attacker to inject SQL commands into the database and expose sensitive data. The CVSS score is 9.3.
CVE-2026-78003 is a critical server-side request forgery (SSRF) vulnerability via path traversal in the WordPress plugin Mailgun for WordPress. It allows an unauthenticated attacker to send requests to internal or external systems originating from the affected server. The CVSS score is 9.8.
This affects all versions of Elementor Pro up to and including 4.2.1, rtMedia up to and including 4.7.11, and Mailgun for WordPress up to and including 2.2.0. Version 4.2.2 of Elementor Pro (released on August 19, 2026) addresses CVE-2026-32475. Version 4.7.12 of rtMedia (released on August 20, 2026) resolves CVE-2026-66592. As of this publication, there is no known patch for Mailgun for WordPress. Affected installations of Elementor Pro and rtMedia should be updated to these versions or higher immediately.
According to Patchstack, the affected WordPress site must contain at least one publicly accessible Elementor form with the file upload field enabled. No login is required to exploit this vulnerability.
The Patchstack advisory mentions only Elementor Pro and refers to the version information for this plugin. The affected file upload field in the Forms module is part of the paid version's feature set. The version of Elementor Pro used in the respective installation is the determining factor for your own assessment.
As of August 22, 2026. This article is intended for general informational purposes only and does not constitute legal, security, or operational advice in specific cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee that the information is up-to-date, accurate, or complete.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-32475
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français