Exploit for CVE-2026-32475

cve · 2026-08-19

Description

Arbitrary file upload in Elementor Pro up to 4.2.1 allows malicious file uploads via unrestricted upload vulnerability.

Entry point

Parameteraction · request body

Pathwp-admin/admin-ajax.php

Unauthenticated file upload to Elementor Pro Forms via admin-ajax.php (action=elementor_pro_forms_send_form) enabling arbitrary PHP file storage and RCE.

CVSS 9.0 for CVE-2026-32475

9.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:HIGH

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

2.4%higher than 82.7% of all CVEs

Updated 2026-09-04

CVE Information

CVE-2026-32475

References

https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin?_s_id=cve

https://patchstack.com/database/wordpress/plugin/elementor-pro/vulnerability/wordpress-elementor-pro-plugin-4-2-1-arbitrary-file-upload-vulnerability?_s_id=cve

Exploit Details

Modified:2026-08-20 18:28

Last Seen:2026-08-23 18:05

Reporter:Patchstack

Other exploits for CVE-2026-32475

CVE-2026-32475

2026-09-04 KitPloitKITPLOIT

CVE-2026-32475-PoC

2026-09-03 KitPloitKITPLOIT

Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE

2026-08-31 KitPloitKITPLOIT

CVE-2026-32475

2026-08-29 KitPloitKITPLOIT

Exploit for CVE-2026-32475

2026-08-27 sahmsecGITHUB

Exploit for CVE-2026-32475

2026-08-25 Boreas37GITHUB

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=CVE-2026-32475
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files.

This issue affects Elementor Pro: from n/a through 4.2.1.

Exploit Code

Share

Share on social media: