External risk intelligence

Elementor Pro Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-32475

Elementor Pro is a widely used web plugin for WordPress. As it functions as a component of public-facing web applications, the features it provides, including file upload capabilities, are frequently exposed to the public internet by design to support site functionality.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Elementor Pro, a popular web design tool for WordPress, could allow attackers to upload and execute malicious files on affected websites. This could potentially lead to unauthorized control of the website. The main concern is confirming if this specific product and version are in use and exposed.

Allows dangerous file uploads.
Widely used web tool, public-facing.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a malicious file through a feature in Elementor Pro. This could lead to an attacker gaining control of the website.

No authentication required.
Upload a dangerous file type.
Full website takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to upload malicious files when supported by the advisory's conditions. This could potentially lead to the execution of arbitrary code on the server, impacting website integrity and availability.

Website files and code.
Uploading specially crafted files.
Website compromise and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Elementor Pro impacts websites using the plugin and requires immediate attention from website owners and the teams managing their web infrastructure. The first practical step is to identify all instances of Elementor Pro, assess their exposure and business criticality, and then confirm the responsible party for remediation.

Website owners/administrators should own.
Verify plugin and site exposure.
Plan for remediation or vendor update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Elementor Pro?

Elementor Pro is a popular website builder plugin for WordPress that allows users to design and customize web pages visually. It is widely used by site administrators to manage layouts and content dynamically. Because it integrates directly into the WordPress environment, it often handles essential site functions, including the processing and storage of user-provided files.

What does CWE-434 mean for CVE-2026-32475?

CWE-434 refers to the Unrestricted Upload of File with Dangerous Type weakness. In the context of CVE-2026-32475, this means the software does not properly verify or limit the types of files being uploaded to the server. An attacker can leverage this oversight to upload malicious files, which the system then treats as valid, potentially enabling them to run unauthorized code on the host server.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the file upload features in affected versions of Elementor Pro. The vulnerability does not require any authentication or user interaction to initiate. Simply accessing the upload mechanism and submitting a specially crafted file is sufficient. Standard, expected file uploads that are properly validated by the system do not trigger this specific issue.

Is my website at risk from this CVE?

According to Halo Surface Signal, Elementor Pro is a web plugin frequently used in public-facing applications. Because its features are often exposed to the internet by design to support site interactivity, any website running an affected version is at elevated risk. If your WordPress site utilizes this plugin to handle file uploads, it is considered potentially accessible to outside threats.

How should I respond to CVE-2026-32475?

Your first step is to perform an inventory of your web infrastructure to identify every site where Elementor Pro is active. Verify the specific version number for each instance to confirm if it falls within the affected range. Once identified, evaluate the criticality of the site and coordinate with your technical team to prioritize and apply the necessary vendor updates to close the upload security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.