CVE-2026-32475

COMPONENT VERSION RANGE

NewScan fingerprints elementor-pro from its response and reports this CVE when the detected version falls inside the affected range below.

9.0, unauthenticated, and being written up as exploited: the elementor_pro_forms_send_form AJAX action validates uploads in one loop and moves them in another, and an EMPTY first file part for the same field makes the validation loop `return` early while the move loop only `continue`s past it - so a second part carrying a .php payload is written to /wp-content/uploads/elementor/forms/ with no extension check. Preconditions are ordinary: one published page with a Form widget that has an upload field enabled, which is the widget's normal use. Affected `n/a through 4.2.1`, patched 4.2.2 (Patchstack). Version source is the standard WordPress-component route scan_wordpress already walks and no new code: Elementor Pro enqueues its own assets as /wp-content/plugins/elementor-pro/<...>?ver=<plugin version>, which wordpress_tools.find_plugins keys by the directory slug `elementor-pro` (this row's key), refined where present by the plugin's readme.txt `Stable tag:`. Version-match only, deliberately: the proof-of-exploit is writing a PHP file into the target's uploads directory, which we will not do to a customer.