Unauthenticated file upload to RCE in Elementor Pro page builder (CVE-2026-32475)
Patchstack disclosed the flaw today with exploitation reported and public exploit code already indexed, so unpatched Elementor Pro sites can be found and taken over by commodity scanners within days.
Elementor Pro through 4.2.1 allows an unauthenticated attacker to upload files of dangerous types, which Patchstack demonstrates can be chained to full remote code execution on the WordPress host. A compromised site gives the attacker the web user's privileges, database credentials, and a foothold for malware distribution.
Affected: Elementor Pro <= 4.2.1 (fixed in 4.2.2)
How to Test
Check the plugin version under Plugins in wp-admin — anything at or below 4.2.1 is vulnerable. Scan wp-content/uploads and Elementor's upload directories for unexpected .php/.phtml files, and review access logs for unauthenticated POSTs to Elementor Pro AJAX/upload endpoints followed by direct GET requests to files in the uploads tree.
How to Patch
Update Elementor Pro to 4.2.2 immediately (Patchstack also offers a vPatch rule for managed mitigation). As a hardening step, block PHP execution in wp-content/uploads via your web server configuration (e.g., an nginx location rule or Apache .htaccess denying .php handlers) and remove any unauthorized files found.