Critical Unauthenticated File Upload Flaw in Elementor Pro Allows Remote Code Execution on WordPress Sites
A critical vulnerability identified as CVE-2026-32475 has been found in the Elementor Pro plugin for WordPress, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on affected sites.
The issue affects all versions prior to 4.2.2 and stems from inconsistent handling of empty filenames between the validation and file-saving routines in the upload module. Researchers at Patchstack determined that an attacker can craft a multipart request where the first part contains a file with no name and the second part delivers a PHP backdoor.
Because the validation loop fails on the empty entry and aborts early, the malicious payload reaches the upload handler, which saves it to the publicly writable directory wp-content/uploads/elementor/forms/. The attacker can then guess the filename based on creation timestamps or obtain the exact path through autoresponder emails in certain configurations.
Successful exploitation requires a published Elementor Pro form that includes a file-upload field with the multiple-file attachment option enabled; this setting is disabled by default. The free version of Elementor, which has more than 10 million installations, is not impacted.
Developers addressed the flaw in Elementor Pro 4.2.2. Site owners should apply the update without delay and inspect the upload directory for unexpected PHP files or other anomalies. The patch does not remove any previously planted backdoors. No active attacks have been recorded so far, but publication of technical details is expected to prompt exploitation attempts.
Related articles
EASM Uncovers Forgotten Perimeter Assets Including 11-Year-Old Servers Invisible to Standard Scanners
EASM solutions continuously discover external attack surfaces by starting from public data such as company names, domains, WHOIS records, Certificate Transparency logs, and internet-wide scanners like Shodan and Censys. Unlike traditional vulnerability scanners that only check assets from a predefined list, EASM maps unknown shadow IT including forgotten test servers, abandoned marketing subdomains, exposed APIs, and cloud buckets left open to the internet. The technology follows the same reconnaissance path used by attackers and has become essential for mature vulnerability management programs after years of being considered exotic. Major vendors including Palo Alto Networks Cortex Xpanse, CyCognito, Qualys, Rapid7, and Tenable now lead the market, while Russian providers such as Positive Technologies PT EASM, BI.ZONE EASM, and CyberOK PenOps have grown rapidly since 2022. Without an established process for prioritization and remediation, EASM implementations risk generating overwhelming alert volumes rather than reducing risk. The approach is now viewed as a core component of Continuous Threat Exposure Management (CTEM) frameworks.
Mozilla Releases Firefox 157 with 76 Security Fixes, Shifts to Individual CVE Reporting
Mozilla Foundation has released Firefox 157, addressing 76 vulnerabilities rated at various severity levels. The update also includes patches for the extended support releases Firefox ESR 153.4, ESR 140.17, and ESR 115.42. A key change in this release involves Mozilla's new approach to publishing security advisories, moving from grouping multiple memory safety issues under single CVEs to reporting them individually. Among the high-severity issues fixed are sandbox escape flaws, privilege escalation bugs, use-after-free errors, uninitialized memory problems, and JIT compiler mistakes affecting components such as DOM, Graphics, WebGPU, WebAssembly, and Networking. The ESR versions received 62, 43, and 31 fixes respectively, with 34 rated high in the latest branch. All listed CVEs range from CVE-2026-100756 through CVE-2026-100831.
Recon in Bug Bounty: Spotting Anomalies Instead of Chasing Known Vulnerability Patterns
The article explains that effective reconnaissance in Bug Bounty programs goes far beyond automated subdomain enumeration with tools like subfinder or httpx. It emphasizes building a mental model of the target application by analyzing policy documents, infrastructure changes via Censys and Shodan, and identifying behavioral anomalies rather than matching textbook vulnerability patterns. A detailed case study describes how a hidden legacy endpoint on ibm.com was discovered during passive and active reconnaissance, leading to the identification of a time-based Blind SQL Injection vulnerability confirmed with sqlmap. The author stresses that recon is a continuous process involving hypothesis testing, understanding service trust boundaries, and evaluating real security impact for triage teams. Practical advice includes reviewing HackerOne reports for context, maintaining motivation through interesting targets, and revisiting programs as infrastructure evolves. The piece also covers how JavaScript analysis and direct endpoint interaction help map authorization flows and weak links between microservices.
Google Releases Chrome Security Update Fixing 32 Vulnerabilities Including One Critical Flaw
Google has issued a security update for its Chrome browser that addresses a total of 32 vulnerabilities across Windows, macOS, and Linux platforms. One vulnerability is rated Critical, while 25 are rated High, one Medium, and five Low. The Critical issue, tracked as CVE-2026-102331, is a buffer overflow in the ANGLE graphics component that was reported externally on August 24. High-severity fixes cover multiple type confusion and buffer overflow problems in the V8 JavaScript engine, use-after-free flaws in Bluetooth, Views, Passwords, FullScreen, and PictureInPicture, plus uninitialized resource handling in GPU and WebGPU. Additional High issues include out-of-bounds writes in GPU, out-of-bounds reads in WebGL, cross-site scripting in WebUI, UI display problems in Omnibox, and permission management weaknesses in Mojo. The update ships as Chrome 154.0.8037.93 and 154.0.8037.92 for Windows and macOS and 154.0.8037.92 for Linux, with gradual rollout over the coming days and weeks.