Quick answers
- Is CVE-2026-32475 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32475 being exploited in the wild.
- How severe is CVE-2026-32475?
- Critical severity, with a CVSS score of 9, published 19 August 2026.
- Which products and versions are affected?
- Elementor Pro through 4.2.1.
- Is there a fix for CVE-2026-32475?
- A patch was published on 2026-08-19: Version 4.2.2 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-32475 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-32475?
- Check whether you run Elementor Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an arbitrary file upload flaw in Elementor Pro versions 4.2.1 and below, specifically in the Forms module's File Upload field (modules/forms/fields/upload.php). The root cause is a logic mismatch between two independent loops: the validation loop returns early when it encounters an empty file entry (UPLOAD_ERR_NO_FILE) on a non-required field, preventing type-checks on subsequent files, while the process_field loop only skips the empty entry and continues processing remaining files. An unauthenticated attacker can submit a multi-part form with an empty file entry followed by a malicious .php file; the validator skips the PHP file entirely, but the processor writes it to a public directory with a .php extension, leading to remote code execution. No authentication or user interaction is required, as the Forms widget is publicly accessible. The patch is available in version 4.2.2.
Affected products
- Elementor Elementor Pro through 4.2.1
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Version 4.2.2 available
- 2026-08-19: kev added: Known to be exploited