Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

A critical flaw in the Elementor Pro WordPress plugin (CVE-2026-32475) allows unauthenticated attackers to upload malicious PHP files by exploiting a discrepancy between how file extensions are validated versus how files are ultimately moved to public directories. Because the validation logic can be bypassed, attackers can write executable PHP code to web-accessible locations without any authentication, achieving full remote code execution. This is particularly dangerous because it requires no user interaction or credentials, dramatically lowering the barrier for exploitation. The vulnerability affects all sites running versions prior to 4.2.2, and given Elementor Pro's widespread adoption across WordPress sites, the attack surface is enormous. Timely patching and strict server-side file upload controls are essential to prevent this class of vulnerability.