Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: WordPress site administrators using Elementor Pro
Incident: Unrestricted file upload vulnerability in Elementor Pro (CVE-2026-32475).
Impact: Unauthenticated remote code execution (RCE) leading to complete server compromise.
Attacker: Unidentified threat actors
Analysis: The flaw stems from a logic discrepancy in the Forms module where file extension validation and the file-move process occur in separate loops. By submitting multiple file parts for a single field, unauthenticated attackers can bypass blocklists and write PHP files to a public directory. This effectively transforms a standard upload field into a remote code execution primitive.
Recommendations: Update Elementor Pro to version 4.2.2 or later immediately.; Audit the ‘wp-content/uploads/elementor/forms/’ directory for unauthorized .php files.; Deploy a Web Application Firewall (WAF) to monitor and block suspicious file upload patterns.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source