CVE-2026-32475
Critical Arbitrary File Upload and Unauthenticated Remote Code Execution in E...
⚡ KEV — Known Exploited
CVSS 9.8 (Critical)
EPSS 0.9780 (1th pct)
Technical Description
Critical Arbitrary File Upload and Unauthenticated Remote Code Execution in Elementor Pro plugin for WordPress versions 4.2.1 and below.
Why this matters to your organisation:
The organisation uses elementor_pro, which is affected by CVE-2026-32475. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.8% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
The organisation uses elementor_pro, which is affected by CVE-2026-32475. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 97.8% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Potential Impact
A vulnerability in elementor_pro rated Critical (CVSS 9.8). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalogue, indicating it has been actively exploited in the wild.
✅ Recommended Next Action
Review the vendor advisory for CVE-2026-32475 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32475
Confidence: High
The installed version exactly matches an affected version.
CVE Details
| Product | elementor elementor_pro |
| Version Range | <= 4.2.1 → ∞ |
| Installed | 4.2.1 |
| Match Type | Exact Match |
| CVSS | 9.8 |
| KEV | YES |
| EPSS | 0.978 |
| Source |
NVD · Aug. 22, 2026 View reference ↗ |
Score Breakdown
⚡ KEV+40
🌐 Exposure+20
⭐ Importance+15
📈 EPSS+14.7
🔢 CVSS+9.8
Total99