vulnerability
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
High
Summary
A critical vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload PHP files and execute code, potentially leading to remote code execution. The flaw stems from a discrepancy in how the plugin handles empty file entries in its File Upload field. While a patch (version 4.2.2) has been released, users should update immediately and monitor for unauthorized modifications on their sites, especially those with multiple authors or contributors.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data