CVE-2026-32475 Elementor Pro: Unrestricted File Upload

Vulnerability CVE-2026-32475 affects Elementor Pro, one of the most widely used page builders in WordPress. According to the official NVD description, this is a flaw that allows unrestricted upload of dangerous file types. An unauthenticated user could upload malicious files to the server, exposing websites to critical risks of remote code execution. It affects all versions up to 4.2.1.

The CVSS score of 9.0 reflects the severity of this flaw. The vulnerability was published on August 19, 2026. In recent days, social media discussions have referenced the flaw in relation to production websites, although widespread active exploitation has not been confirmed. No publicly available exploits have been identified in known repositories.

System administrators and IT teams must immediately verify the version of Elementor Pro in use. If a version equal to or lower than 4.2.1 is installed, it is essential to apply the update as soon as it becomes available. In the meantime, review file upload permissions in the plugin, restrict access to critical functions, and monitor upload logs for suspicious activity.