Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

A critical vulnerability has been discovered in the Elementor Pro WordPress plugin, which could allow remote code execution if exploited. The flaw is related to the unrestricted upload of dangerous file types in the Forms module's File component. This vulnerability has a CVSS score of 9.0 out of 10.0, indicating a high level of severity. It is identified as CVE-2026-32475. The issue could potentially be exploited by unauthenticated attackers to upload PHP files and execute code.