{"uuid": "4345cfd0-46c4-4b37-9753-46ea2ef98e31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32475", "type": "seen", "source": "https://t.me/captainsmok3r_official/454", "content": "CVE-2026-32475\nUnrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.\nsource: https://nvd.nist.gov/vuln/detail/CVE-2026-32475\nBase Score:\u00a09.0\nThe Elementor Pro plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 4.2.1 via the process_field function. This is due to a validation loop in Upload::validation() using 'return' instead of 'continue' when the first array element has UPLOAD_ERR_NO_FILE, aborting all extension and file type checks for remaining files in the same upload field. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This requires that the targeted site has published a page containing an Elementor Pro Form widget with at least one non-required File Upload field.\ncheck version:\nsite[.]com/wp-content/plugins/elementor-pro/readme.txt", "creation_timestamp": "2026-08-21T00:00:07.928767Z"}