What is CVE-2026-32475?
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
Timeline
- 2026-08-19Published to the U.S. National Vulnerability Database (NVD)
- 2026-08-20NVD record last updated
- 2026-09-07First covered in a defend.network daily briefing
Affected product
See advisory
Remediation Steps
- Update Elementor Pro plugin to the latest patched version immediately
- Scan WordPress sites for webshell artifacts and malicious scripts injected by exploitation
- Review server logs for unauthorized command execution activity
- Implement Web Application Firewall (WAF) rules to detect and block exploitation attempts
References
- https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin?_s_id=cve
- https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
- https://nvd.nist.gov/vuln/detail/CVE-2026-32475
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 5 of August 2026 (August 31 – September 6)
- MikroTik routers, Magento zero-day, and Chromium V8 actively exploited (2026-09-07)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.