Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-32475 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-19 |
| Vendor | WordPress |
| Product | Elementor Pro (plugin) |
| CVSS Score | 9.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Required Actions
- Update Elementor Pro to a version newer than 4.2.1. Premium plugin updates require an active license — check whether yours has expired, because an expired license silently blocks security updates.
- This alert is an exception to our rule of skipping WordPress plugins. Scale justifies it: Elementor Pro is one of the most widely deployed page builders, including on local government and public institution websites.
- Check
wp-content/uploadsfor executable files (.php,.phtml) — unrestricted upload leaves traces. The presence of such a file means an update is not enough and post-incident analysis is required. - Disable PHP execution in the uploads directory at the server level. This protection works independently of plugins and guards against the whole class of similar vulnerabilities, not just this one.
Who Is Affected?
Organizations running WordPress sites with Elementor Pro through version 4.2.1. This includes local government and public institution websites, where the plugin is widely used and update cycles are often irregular.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
