Researchers disclosed a critical flaw in Elementor Pro, tracked as CVE-2026-32475, that can let an unauthenticated attacker upload a PHP file and achieve remote code execution on WordPress sites running versions up to 4.2.1. The report also notes a separate WordPress core issue involving malicious Postscript uploads, while a large-scale operation called StopAndProtect is abusing compromised WordPress sites for malware delivery and command-and-control. #ElementorPro #CVE202632475 #WordPress #StopAndProtect
Keypoints
- CVE-2026-32475 affects Elementor Pro versions up to 4.2.1.
- The flaw allows unrestricted upload of dangerous files through the Forms module.
- An unauthenticated attacker can bypass extension checks by submitting two file parts.
- A PHP file can be written into a public uploads directory, enabling remote code execution.
- Patchstack reported the issue, and Elementor Pro 4.2.2 fixes it.
Read More: https://thehackernews.com/2026/08/elementor-pro-flaw-could-let.html