CVE-2026-32475

This vulnerability is like a “bad file upload” door in your WordPress add-on. If an attacker can reach it, they can upload a dangerous file (often a webshell) that lets them run commands on your website’s server. That can turn your site into a tool the attacker controls, not just a website you manage.

This matters if you run WordPress and have the Elementor Pro plugin installed, specifically version 4.2.1 or earlier. The findings indicate the attack does not require a login and does not require you to click anything, and it is reachable in default configuration.

Only treat it as a real risk if the vulnerable Elementor Pro version is actually installed and reachable over the network to attackers.

This is RED because confirmed active exploitation in the real world has been reported, with large numbers of blocked attempts starting 2026-08-19. Since the issue is network-reachable in default configuration and does not require a login, attackers don’t need to “trick” users to trigger it.

Patch Elementor Pro 4.2.1 or earlier to at least 4.2.2 immediately.

1. Confirm exposure

   • In WordPress admin, check the Elementor Pro plugin version.
   • Confirm whether you are on Elementor Pro 4.2.1 or earlier.
   • Confirm the plugin is installed on the publicly reachable site(s) (including staging if it is internet-accessible).

2. Patch (primary fix)

   • Upgrade Elementor Pro to the latest available version.
   • Minimum required fix: at least 4.2.2.
   • If your organization uses multiple environments, upgrade production first, then re-check versions in staging.

3. Immediate containment if you cannot upgrade right away

   • Temporarily disable Elementor Pro on the affected WordPress site(s) until the upgrade is complete.
   • Reduce exposure during the window: restrict public access where possible (for example, IP allowlisting or maintenance mode), especially if you cannot patch immediately.

4. Check for signs of compromise after patching

   • Review web server logs and WordPress-related logs around the time you suspect attempts began (notably starting 2026-08-19 per reporting).
   • Look for unusual file uploads, unexpected new files, or webshell-like behavior.
   • Validate the file tree for changes outside normal plugin/theme update activity.

5. Ongoing monitoring

   • Continue log monitoring for repeated upload attempts or suspicious requests targeting file upload functionality.
   • If you detect any malicious files, remove them and consider rotating any exposed credentials used by the server/WordPress.

6. CISA KEV due date

   • KEV entry: not listed in CISA KEV for this CVE per the provided findings.

Severity is effectively critical for affected sites: the reported impact enables attackers to upload malicious files that can allow arbitrary code execution. The weakness aligns with CWE-434 (unrestricted upload of dangerous file types), and the findings specify: no authentication required, network access required, no user interaction required, and reachable in default configuration.

Exploitation status: confirmed active exploitation has been reported in the wild, including webshell payload delivery, with large-scale exploitation attempts blocked beginning 2026-08-19 (per the provided reporting). No CISA KEV listing was found in the provided findings.

Attack mechanism (how it triggers): an attacker reaches the vulnerable Elementor Pro functionality and uploads files containing malicious code to the server, enabling subsequent execution.

EPSS: a prediction of 2.4% is noted with a flat trend, but real-world exploitation confirmation takes precedence in urgency decisions.

Fix availability: update Elementor Pro to at least 4.2.2 (latest available version).