VulnerabilityBleeping Computer
9.0 — CRITICAL
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical vulnerability in Elementor Pro allows attackers to upload executable files for remote code execution on the server, putting websites with published Elementor forms containing a File Upload field at risk.
⚙️Technical Details
CVEs
CVE-2026-32475
Affected Systems
Elementor Pro versions before 4.2.2
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Websites that use an Elementor Pro Form with an upload file form field and the multiple file upload option enabled
🛡️Recommended Actions
1Update to the latest Elementor Pro release
2Check the ‘wp-content/uploads/elementor/forms/’ directory for PHP files or other rogue files
3Thoroughly examine uploaded files and directories for malicious activity
📦Affected Products
Elementor Pro versions before 4.2.2
🔐NVD Verified DataVERIFIED
CVE-2026-32475 ↗CVSS 9 — CRITICAL
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HWeaknesses
CWE-434
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.