SECURITYAug 20 · 06:04 UTCTHE HACKER NEWS[email protected] (The Hacker News)

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers disclosed a critical flaw in the Elementor Pro WordPress plugin that could allow unauthenticated attackers to upload PHP and execute code. The vulnerability, designated CVE-2026-32475, has a CVSS score of 9.0 out of 10.0 and involves an unrestricted file upload mechanism within the Forms module.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

Elementor ProorganizationWordPresstopiccybersecurity researcherspersonCVE-2026-32475topicPHPtopicForms moduletopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYJun 5 · 08:38 UTC
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites
SECURITYJul 20 · 21:57 UTC
Attackers pummel critical WordPress vuln to create all sorts of mischief
SECURITYApr 7 · 22:03 UTC
Hackers exploit critical flaw in Ninja Forms WordPress plugin
SECURITYJun 6 · 14:09 UTC
Critical Everest Forms Pro flaw exploited to take over WordPress sites