{"uuid": "ed30e65f-e671-495c-ae80-5aff26b41f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32475", "type": "seen", "source": "https://t.me/pphm_HackerNews/2754", "content": "\ud83d\udd34 Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code\n\nCybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remote code execution.\n\nThe vulnerability, tracked as CVE-2026-32475, carries a CVSS score of 9.0 out of 10.0. It has been described as a case of unrestricted upload of a file with a dangerous type.\n\n\"The flaw lives in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with different handling of empty file entries,\" Patchstack said.", "creation_timestamp": "2026-08-21T23:00:05.570155Z"}