Elementor Pro CVE-2026-32475

Exploitation requires network access to a WordPress site running Elementor Pro at or below version 4.2.1 with the vulnerable upload functionality reachable, and no authentication (CVSS PR:N) or user interaction (UI:N) is needed. The limiting factor is the CVSS AC:H rating: the attacker must meet a specific non-default condition or precise code-path requirement (for example a particular form/upload feature being configured and exposed, or a validation-bypass precondition) rather than trivially uploading a file against any default install - the exact configuration prerequisite is not enumerated in the provided data and should be confirmed against the Patchstack advisory. Sites that do not expose the affected upload widget/endpoint are correspondingly harder to exploit.

The signals point to genuine high priority, with some caveats. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.0 critical) indicates a network-reachable, unauthenticated (PR:N) attack requiring no user interaction, with full confidentiality, integrity and availability impact and a scope change - consistent with webshell-driven RCE that escapes the plugin's security boundary to the host. The one moderating factor is AC:H, meaning the attacker must satisfy some non-trivial condition or win a specific code path rather than trivially POST a file; this tempers the otherwise worst-case profile. EPSS is not provided, and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation; likewise no public POC is referenced. The combination of unauthenticated network access, RCE outcome, and a very large install base makes this a strong patch-now candidate despite the missing exploitation telemetry - but the AC:H rating and absence of an EPSS/KEV signal mean widespread automated exploitation is not yet confirmed.

A remote, unauthenticated attacker locates a WordPress site running a vulnerable Elementor Pro build and abuses the flawed upload handler to submit a PHP file disguised as or bypassing an allowed type, satisfying the specific condition implied by the AC:H rating. Once the file lands in a web-accessible directory, the attacker requests its URL to execute the code, obtaining a webshell and server-side command execution. No public POC is referenced, but Patchstack characterizes the issue as a file-upload-to-RCE chain.