WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
CVSS score
9.0
EPSS probability
%2.0
Risk score
0.2
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE
A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via validation/move loop desync)
PoC for CVE-2026-32475: Elementor Pro <=4.2.1 unauthenticated file upload to RCE. Stdlib-only Python.
CVE-2026-32475 — unauthenticated arbitrary file upload in Elementor Pro <= 4.2.1 (CVSS 9.0, CWE-434). PoC for authorised testing. (★1)
Nuclei: Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-32475"