WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
85Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9epss 2.4%
from disclosure to weapon2 days
Published on NVDAug 19
1st PoC+2d
VulnCheckAug 19
exploitation probability
2.4%top 17% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Elementor · Elementor Propublic PoCs found — 7
githubgithub.com/absholi7ly/Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE★ 5githubgithub.com/Boreas37/CVE-2026-32475-PoC★ 2githubgithub.com/0xBlackash/CVE-2026-32475★ 0githubgithub.com/sahmsec/CVE-2026-32475★ 0vulncheckvulncheck.com/xdb/2f74a8f09246unverifiedvulncheckvulncheck.com/xdb/1cb9312076deunverifiedvulncheckvulncheck.com/xdb/36cccb8efae9unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.