Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler
Elementor Pro plugin for WordPress in versions <=4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation() and process_field() methods iterate over submitted file entries with different early-exit logic for UPLOAD_ERR_NO_FILE entries. When an attacker submits two file parts for the same upload field — an empty first entry (blank filename triggering UPLOAD_ERR_NO_FILE) followed by a payload — validation() returns early after the empty entry without ever type-checking the payload, while process_field() only skips (continue) the empty entry and moves the payload to wp-content/uploads/elementor/forms/. The AJAX action elementor_pro_forms_send_form requires no authentication or nonce.
Enter a domain you own and we will test it right now — and, while we are there, report anything else it exposes publicly. No account, no agent to install.
How to fix it
Update Elementor Pro to version 4.2.2 or later. The fix aligns the validation() and process_field() loops to consistently handle empty file entries.
What this check actually does
- Fingerprints the host — server, technologies, certificate and response headers.
- Runs the Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler detection against it.
- Runs a short pass for common misconfigurations, exposed files and TLS problems.
- Cross-references the detected versions against published CVEs.
Everything is read-only: requests for pages your server already serves to anyone. Nothing is written, exploited or brute-forced, and no traffic is generated beyond a normal crawl.