PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC

github.com | vulnerability | Critical | CVE-2026-32475 | #bug-bounty | #rce | #wordpress | #red-team | #poc | #file-upload | #cve-2026-32475 | #elementor
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Docker lab and PoC for CVE-2026-32475: an unauthenticated file-upload flaw in Elementor Pro Forms (≤4.2.1) where a loop desync bypasses extension blocklists, plus uniqid() filename recovery for RCE.

Why it matters

Highlights a critical loop desync vulnerability in form upload processing, demonstrating how multipart handling flaws can bypass extension blocklists and achieve unauthenticated RCE on WordPress targets.
CVE
CVE-2026-32475
Vendor
Elementor
Product
Elementor Pro
Affected versions
<= 4.2.1
CVSS
9.8
Published
Collected

Related coverage

Critical · vulnerability · github.com
CVE-2026-111497: Unauthenticated WordPress RCE Exploit Chain PoC via Brotli Decoder Flaw
Demonstrates a reliable, real-world weaponization of the Brotli decoder memory corruption flaw in web application environments without requiring information leaks or debugging instrumentation. Highlights the critical risk of untrusted compressed streams in server-side HTTP clients.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
Back