Blog Elementor Pro 4.2.2 fixes a file-upload flaw under active attack
Elementor Pro 4.2.2 fixes a file-upload flaw under active attack
Attackers are exploiting a critical file-upload flaw in Elementor Pro 4.2.1 and earlier. Elementor shipped 4.2.2 as the fix. The CVSS is 9 and no login is needed.
Attackers are exploiting a critical file-upload flaw in Elementor Pro, the paid version of the Elementor site builder. The bug lets a caller with no account send the server a file the server will run. Wordfence reports live attacks on sites that still use 4.2.1 or older. Elementor shipped 4.2.2 as the fix.
Anyone still on an older release should treat the update as an emergency. After the update, check the uploads folder for files that nobody put there.
elementor-pro 4.2.2
The CVE record puts this in class CWE-434, “Unrestricted Upload of File with Dangerous Type”. In plain terms, the plugin accepts an upload from a caller who is not logged in. It does not stop that upload when the file is one the server will run. A PHP file uploaded this way sits inside the site. A later HTTP request runs it. That is the shortest path from a stranger to code running as the web server.
The CVSS score is 9. The vector reads AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Network reach, no login, no user click. Attack complexity is marked high, so the exploit needs a condition to line up. Live attack traffic tells us the condition is not hard to meet in practice.
The advisory does not name the endpoint or the parameter. Elementor Pro is a paid product. Its source code is not in the wordpress.org directory, so a reader cannot open the fix and read it. The useful checks sit on the site itself. Look at the plugin version in the admin dashboard. Look in wp-content/uploads for recent PHP or .phtml files. Look for files with double extensions like .php.jpg. Look for any file whose name looks like a random string. Anything the site did not put there has to come off.
Facts on this one:
- Affected: Elementor Pro 4.2.1 and earlier
- Patched: 4.2.2
- CVE: CVE-2026-32475, CVSS 9
- Class: CWE-434, unrestricted upload of a dangerous file type
- Login required: no
- Active exploitation: yes, on real sites today
- Install count: not published for this plugin
Steps for a site owner today:
- Update Elementor Pro to 4.2.2 from the Elementor account dashboard.
- Search
wp-content/uploadsfor PHP or.phtmlfiles that should not be there. - Rotate the passwords of every administrator account.
- Run a full malware scan and check the file system for changes since last week.
No install count is published for Elementor Pro, because the paid version sits outside the wordpress.org directory. That does not make the file check optional. An unauthenticated upload with a live exploit is the exact case a site scanner has to catch. The attacker never logs in, and the audit log has nothing to show. Run the file check on every site that carries this plugin, whether the update has arrived on it or not.
Tags: #wordpress , #plugin , #cve , #exploit