CVE-2026-32475: critical vulnerability in Elementor Pro
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Published · Updated
85Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9epss 2.0%
from disclosure to weapon2 days
Published on NVDAug 19
1st PoC+2d
VulnCheckAug 19
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
yesVulnCheck
13 public exploit(s)
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Elementor · Elementor Propublic PoCs found — 13
githubgithub.com/absholi7ly/Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE★ 12githubgithub.com/dinosn/cve-2026-32475-elementor-pro-lab★ 8githubgithub.com/Boreas37/CVE-2026-32475-PoC★ 6githubgithub.com/4minx/CVE-2026-32475★ 1githubgithub.com/sahmsec/CVE-2026-32475★ 1githubgithub.com/cyeezy08/WordPress_Exploit_Directory★ 1githubgithub.com/0xBlackash/CVE-2026-32475★ 0vulncheckvulncheck.com/xdb/36cccb8efae9unverifiedvulncheckvulncheck.com/xdb/8a96c7ee7ef8unverifiedvulncheckvulncheck.com/xdb/bcbfc09e15ffunverifiedvulncheckvulncheck.com/xdb/b175b0fed8fcunverifiedvulncheckvulncheck.com/xdb/2f74a8f09246unverifiedvulncheckvulncheck.com/xdb/1cb9312076deunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Elementor Pro
In the same product, most dangerous first.
CVE-2024-23523MEDIUMWordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerabilityEPSS 0.5%CVE-2024-35656HIGHWordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-35050MEDIUMWordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerabilityEPSS 0.3%