Kenyan organisations operating WordPress websites with Elementor Pro should urgently assess their exposure to CVE-2026-32475.
The vulnerability, rated CVSS 9.0, affects Elementor Pro versions up to and including 4.2.1.
Under vulnerable configurations, an unauthenticated attacker could bypass file-extension checks, upload a malicious PHP file and potentially execute code on the affected server.
A fixed version, Elementor Pro 4.2.2, has been released.
Government agencies, businesses, schools, NGOs and other organisations operating public-facing WordPress websites should update immediately where affected.
Administrators should also inspect web directories for unexpected PHP files, review administrator accounts and plugins, and investigate unusual upload activity, redirects or outbound connections.
Public websites are continuously exposed to the internet. Keeping plugins and themes updated is therefore an essential part of organisational cybersecurity.