Elementor Pro shipped 4.2.2 to fix CVE-2026-32475, a critical unauthenticated flaw that hit the security press this week. The bug lives in the plugin's Forms module: the file-upload field checks a file's extension in one loop and moves it to disk in a second, and the two loops disagree about how to treat empty entries. Send two file parts for the same field and the blocklist check reads one while the move step writes the other — enough to plant a `.php` file in a public directory and execute it. No login required, which is what pushes this to a 9.0 and makes it worth interrupting your afternoon for. Elementor Pro runs on a large slice of the WordPress ecosystem, so the exposure is broad and the fix is simple: update to 4.2.2. Tin Pham reported it through Patchstack's bug-bounty program; the vendor had the details in mid-July and shipped the patch on August 19. There's no confirmed in-the-wild exploitation yet, but the mechanism is easy to reason about once it's public, and file-upload-to-RCE bugs on this kind of install base rarely stay theoretical for long.