Critical Unauthenticated File Upload Flaw in Elementor Pro Allows Remote Code Execution on WordPress Sites
A critical vulnerability identified as CVE-2026-32475 has been found in the Elementor Pro plugin for WordPress, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on affected sites.
The issue affects all versions prior to 4.2.2 and stems from inconsistent handling of empty filenames between the validation and file-saving routines in the upload module. Researchers at Patchstack determined that an attacker can craft a multipart request where the first part contains a file with no name and the second part delivers a PHP backdoor.
Because the validation loop fails on the empty entry and aborts early, the malicious payload reaches the upload handler, which saves it to the publicly writable directory wp-content/uploads/elementor/forms/. The attacker can then guess the filename based on creation timestamps or obtain the exact path through autoresponder emails in certain configurations.
Successful exploitation requires a published Elementor Pro form that includes a file-upload field with the multiple-file attachment option enabled; this setting is disabled by default. The free version of Elementor, which has more than 10 million installations, is not impacted.
Developers addressed the flaw in Elementor Pro 4.2.2. Site owners should apply the update without delay and inspect the upload directory for unexpected PHP files or other anomalies. The patch does not remove any previously planted backdoors. No active attacks have been recorded so far, but publication of technical details is expected to prompt exploitation attempts.
Related articles
10 Non-Obvious S3 Integration Vulnerabilities Exposed in Web Application Bug Bounty Research
Security researcher Sergey Bobrov, known as BlackFan, published a detailed analysis of S3 misconfigurations when integrated into web applications via proxies such as nginx. The article examines ten laboratory setups demonstrating issues ranging from stored XSS and bucket takeover to rewrite rule bypasses and cache poisoning. Key findings highlight how nginx path normalization differences, missing trailing slashes, and variable usage like $uri enable attackers to reach arbitrary buckets or inject HTTP request splitting payloads. The research covers both direct S3 client usage and proxy-based integrations, emphasizing ACL and Bucket Policy errors that expose data to any authenticated S3 user worldwide. Practical demonstrations include exploitation of Ceph RGW path traversal with ../ sequences and cache key collisions via response-content-type parameters. The work provides fingerprinting tables for identifying S3-compatible systems including MinIO, Ceph RGW, and Yandex Cloud based on headers and error responses.
Asset and Vulnerability Management in Practice: Building a Working Process with MaxPatrol VM and NetBox
This detailed guide explains how organizations can implement effective asset and vulnerability management by focusing on reliable infrastructure data, IT collaboration, and automation. It draws from real-world projects using MaxPatrol VM, NetBox, and 1C:ERP to demonstrate dynamic grouping, webhook-driven asset onboarding, and deviation-based control. The approach emphasizes eight core principles including minimizing human dependency, just-in-time awareness, maximum data accuracy, and embedding security into existing IT workflows. Technical flows cover automatic scanning initiation upon asset creation in NetBox, categorization against unacceptable events, and priority-based patching cycles aligned with Patch Tuesday. Self-control mechanisms and PDQL queries enable ongoing validation of subnets, asset freshness, and compliance without excessive manual oversight. The framework is designed to be adaptable to any mature vulnerability management platform beyond the specific tools demonstrated.
Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit
Google has released Chrome 153 for Windows, macOS, and Linux, addressing a total of 230 security vulnerabilities. The update includes fixes for five critical-severity issues and one confirmed zero-day vulnerability already exploited in the wild. Among the critical flaws are use-after-free bugs in WebGL tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write CVE-2026-87438, a buffer overflow CVE-2026-87527, and a use-after-free in the Cast component identified as CVE-2026-87628. A medium-severity out-of-bounds write in the V8 JavaScript engine, CVE-2026-87491, was reported on August 6, 2026 and has seen active exploitation. The company is rolling out the patches gradually over the coming days and weeks across all supported platforms.
Microsoft Addresses 973 Vulnerabilities in September Security Update
Microsoft released its monthly security updates on September 8, 2026, fixing 973 vulnerabilities tracked by CVE identifiers. The release coincided with Patch Tuesday and also resolved four third-party software flaws. Affected products span Windows, Office, SQL Server, Azure, Microsoft Dynamics, SharePoint Server, and various development tools. Among the issues, 258 allow remote code execution and 438 enable privilege escalation. A total of 113 vulnerabilities received the highest severity rating of Critical, while the remaining 860 were rated Important. Several of the flaws have already been observed in active exploitation.