CVE-2026-32475 is an unauthenticated arbitrary file upload to RCE in Elementor Pro (<= 4.2.1, fixed in 4.2.2). CVSS 9.0 (CWE-434). If you run WordPress with Elementor Pro forms that accept file uploads, patch and audit the uploads directory today.
The bug: return where continue belonged
The flaw is in the Form widget's upload path (process_field -> Upload::validation()). The validation loop iterates over the file array for one field. When the first element has UPLOAD_ERR_NO_FILE (empty filename), the code calls return instead of continue — aborting extension and MIME checks for every remaining file in that field. The mover runs in a separate loop that correctly skips the empty slot and writes the rest. Validator stops early, mover keeps going.
Exploit shape (observed in the wild by Wordfence):
POST /wp-admin/admin-ajax.php
