A newly disclosed vulnerability in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload and execute arbitrary files, threatening millions of websites according to Wordfence.
Tracked as CVE-2026-32475, the flaw carries a CVSS score of 9.8 and resides in the widget handling component of the plugin as reported by SecurityOnline as reported by SecurityOnline.
Versions up to and including 4.2.1 do not properly validate file upload requests, enabling an attacker to send a crafted PHP file that is stored in the web root and then triggered via a direct web request as noted by The Hacker News as noted by The Hacker News.
The Wordfence team notes that roughly six million installations of Elementor Pro are exposed, though no public exploitation attempts have been observed to date and no specific threat actor has been linked to the issue according to its advisory according to its advisory.
Administrators should update to Elementor Pro version 4.2.2 as soon as possible, review any unexpected files in the wp-content/uploads directory, and consider adding a web application firewall rule that blocks unknown file extensions in upload endpoints as advised by SecurityOnline as advised by SecurityOnline.
Regular backups and monitoring of filesystem changes can help detect any malicious uploads that may have occurred before the patch is applied.