Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers disclosed a critical RCE vulnerability in the Elementor Pro WordPress plugin (CVE-2026-32475, CVSS 9.0) where a flaw in the Forms module's File Upload field allows unauthenticated attackers to bypass extension checks and write PHP files to wp-content/uploads/elementor/forms/, enabling remote code execution; a patch (v4.2.2) was released August 19, 2026. The report also notes a recent WordPress core RCE fix (CVE-2026-65640) and highlights a large-scale operation dubbed 'StopAndProtect' abusing compromised WordPress sites for malware delivery and C2, advising users to update, scan for unauthorized changes, and audit accounts and plugins.