Search: “elementor”

22 stories

Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.

Patchstack researcher Tin Pham reported an unrestricted file upload flaw in Elementor Pro's Forms module (CVE-2026-32475, CVSS 9.0), affecting all versions up to and including 4.2.1. Submitting two file parts for one field bypasses the extension blocklist and writes attacker-controlled PHP into a public uploads directory, yielding unauthenticated remote code execution when a published Elementor page uses a Form widget with a File Upload field. A patched version 4.2.2 shipped August 19, 2026, a day after WordPress 7.0.4 fixed CVE-2026-65640 (CVSS 8.8), an RCE via Postscript file upload when Imagick and Ghostscript are in use.

The Hacker NewsAug 20, 06:04 UTC · 27d agoVulnerability CVE-2026-32475 CVE-2026-656401

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

The Hacker NewsAug 11, 05:48 UTC · Aug 11, 2026Vulnerability CVE-2026-18072 CVE-2026-64638

Essential Addons for Elementor XSS Vulnerability Discovered

Infosecurity MagazineFeb 24, 17:00 UTC · Feb 24, 2025Vulnerability CVE-2025-24752

A flaw in the Essential 'Addons for Elementor' WordPress plugin poses 1M sites at risk of hacking

Security AffairsMay 12, 08:10 UTC · May 12, 2023Vulnerability CVE-2023-32243

Critical RCE Flaw Reported in WordPress Elementor Website Builder Plugin

The Hacker NewsApr 18, 05:47 UTC · Apr 18, 2022Vulnerability

Flaw in Elementor and Beaver Addons Let Anyone Hack WordPress Sites

The Hacker NewsDec 15, 00:00 UTC · Dec 15, 2019Vulnerability in the wild

A flaw in outdated versions of Beaver Builder and Elementor plugins allows hacking WordPress sites

Security AffairsDec 13, 12:50 UTC · Dec 13, 2019Vulnerability

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

Elementor Pro WordPress plugin has an unauthenticated arbitrary file upload flaw in its Forms module allowing remote code execution.

Patchstack disclosed a critical unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin that can lead to remote code execution. The flaw is in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with inconsistent handling of empty file entries. The writeup describes exploitation via crafted upload submissions; no CVE id or evidence of in-the-wild exploitation is given in the post.