Critical File Upload Vulnerability in Elementor Pro
Elementor Pro through 4.2.1 has an unrestricted file upload flaw (CVSS 9.0) enabling attackers to plant webshells and run commands on WordPress servers.
- Vendor
- Elementor
- Product
- Elementor Pro
- CVSS
- 9.0
- EPSS (exploit probability)
- 2.0%
- Status
- exploited-in-wild
- Published
Is CVE-2026-32475 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-32475 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 2.0% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-32475 is an unrestricted file upload vulnerability in Elementor Pro, the premium page builder plugin for WordPress. NVD categorizes the issue as “Unrestricted Upload of File with Dangerous Type” and assigns it a CVSS 9.0 (critical) score.
Versions through 4.2.1 are affected. The fix is in version 4.2.2. Active exploitation delivering webshell payloads was confirmed in September 2026. If you’re running any version of Elementor Pro at or below 4.2.1, update immediately: the plugin dashboard or a direct download from Elementor’s site will get you there.
