CVE-2026-32475: WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.
This issue affects Elementor Pro: from n/a through 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Elementor Pro pluginto a version that resolves this vulnerability.Fixed in 4.2.2 - Operational
After upgrading Elementor Pro from versions up to 4.2.1 to at least 4.2.2, review any file uploads made during the vulnerable window and remove any malicious or unexpected uploaded files.
Event History
Frequently Asked Questions
Which sites should be treated as exposed?
Sites running Elementor Pro versions through 4.2.1 should be treated as affected, particularly if the site is reachable over the network. The provided data does not state whether any default configuration or specific feature must be enabled.
Does an attacker need an account or user interaction to exploit this?
No privileges and no user interaction are required according to the vector. Exploitation is network-accessible, although the attack complexity is rated high.
How can I determine whether my site is affected?
Check the installed Elementor Pro version. Versions up to and including 4.2.1 fall within the stated affected range.
What is the potential security impact?
The vulnerability permits upload of dangerous file types. The assigned vector indicates high potential impact to confidentiality, integrity, and availability, with scope change.