Filtered by category: WordFence, tag: elementor pro × Clear
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-32475, CVSS 9.8) in Elementor Pro affects versions up to 4.2.1. A validation loop flaw allows attackers to bypass file type checks and upload executable PHP files, enabling remote code execution. Exploitation requires a published form with a non-required file upload field. Patch 4.2.2 was released August 19, 2026. Wordfence has blocked over 190,000 exploit attempts since disclosure.
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was patched in Elementor Pro, a WordPress plugin with around 6 million active installations. Discovered July 24, 2026, the flaw allows attackers without credentials to upload executable PHP files, potentially enabling remote code execution and complete site takeover. Users should update immediately.