Critical Unauthenticated RCE Vulnerability Discovered in Elementor Pro WordPress Plugin

Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution. The vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type. The flaw lives in the Forms module's file upload functionality, where insufficient validation allows unauthenticated attackers to upload PHP files. Successful exploitation could allow execution of arbitrary code on affected WordPress sites, potentially leading to full site compromise. The Elementor development team has been notified, and users are urged to update to the latest patched version immediately. As of the initial disclosure, details regarding active exploitation in the wild are pending further analysis and vendor confirmation.