Loading vulnerability…
CVE-2026-32475 is a critical unrestricted file upload vulnerability in the Elementor Pro WordPress plugin affecting versions through 4.2.1. The flaw is in the Forms module's File Upload field, where upload validation and file movement are performed in separate loops that handle empty file entries inconsistently. In the validation path, an empty non-required file entry can cause early return behavior, while in the processing path the empty entry is skipped and subsequent entries are still moved. By submitting multiple file parts for the same upload field, including an empty first entry followed by a malicious server-executable file, an unauthenticated attacker can bypass extension validation and cause the malicious file to be written into a web-accessible uploads directory. Because the stored file retains the attacker-controlled executable extension and is reachable over the web, successful exploitation can result in remote code execution on the affected WordPress site.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical unauthenticated file upload vulnerability in the Elementor Pro WordPress plugin Forms/File Upload field that can bypass extension blocking and lead to remote code execution by writing a PHP file into a public directory.
A critical unrestricted file upload vulnerability in the Elementor Pro WordPress plugin's Forms module File Upload field that can allow unauthenticated remote code execution by uploading a PHP file to a public directory.
An unrestricted file upload vulnerability in Elementor Pro that can allow malicious file upload; the referenced Patchstack material indicates this can lead to remote code execution.
An unauthenticated arbitrary file upload vulnerability in the Elementor Pro plugin Forms module that can lead to remote code execution by bypassing extension validation and uploading a PHP file to a public web-accessible directory.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.