Elementor Pro versions up to 4.2.1 include an unrestricted file upload flaw that allows attackers to upload arbitrary files with dangerous types. Because the plugin does not validate the MIME type or file extension, a malicious user can place a PHP script or other executable code onto the server, enabling potential unauthorized use of uploaded files. The weakness is classified as CWE‑434, unauthorized file upload.

WordPress sites using the Elementor Pro plugin, specifically any installation from the initial release of the plugin through version 4.2.1, are susceptible. This includes all WordPress installations where the plugin is active, regardless of other security settings.

The CVSS score of 9 indicates critical severity, and the lack of a current EPSS score does not diminish the likelihood of exploitation, as attackers have no authentication requirements. The vulnerability is not yet listed in the CISA KEV catalog, but unauthorized upload functionality makes exploitation straightforward from the public web interface. The likely attack vector is unauthenticated, via the plugin's file upload endpoint, and an attacker could upload malicious files.