CVE-2026-32475
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
Early warning: exploitation observed
- Exploitation observed since Aug 19, 2026
- Not yet in the official CISA catalogue
- Attacked 1 day before the vulnerability was made public
Source: VulnCheck KEV · Sep 3, 2026 Sep 3, 2026 Aug 19, 2026
CVSS score9.0 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HWeakness type (CWE)CWE-434
Related articles
WordPress Under Attack: More Than 440,000 Attempts Target Super Forms and Elementor Pro
Over 440,000 attacks exploit critical unauthenticated file upload flaws in Super Forms and Elementor Pro, enabling remote code execution. Update now.
Elementor Pro, Critical Vulnerability in Forms: File Upload Could Lead to Code Execution
Critical flaw in Elementor Pro (CVE-2026-32475) lets attackers upload PHP files to execute code remotely. Affects versions before 4.2.2. Update immediately.
This product uses the NVD API but is not endorsed or certified by the NVD.