Elementor Pro Arbitrary File Upload Flaw Bypasses Validation on Empty Array Slots

The flaw sits in the form submission handler. When a multi-file field array hits an empty index, the loop returns early instead of skipping, leaving subsequent entries unchecked. The processing function then writes the second payload to disk because the empty slot was silently ignored. Defiant recorded 190,000 blocks within days of the 19 August 2026 patch release, confirming immediate in-the-wild use. Two-thirds of Elementor’s 10 million installations remained on vulnerable versions as of 4 September. The affected code path exists only in the Pro Form widget; free plugin users are untouched. Post-patch exploitation timing matches patterns seen in earlier WordPress plugin disclosures where public fixes become reconnaissance maps for automated scanners. Site operators must scan the forms directory for unexpected .php files and review admin-ajax.php logs for repeated form submissions. The 9.8 CVSS score and unauthenticated vector make mass scanning likely; no state attribution exists because the payload is generic and leaves no distinctive network artifacts beyond the written file. Elementor has not published exploit telemetry. Independent monitoring shows continued probing of the fixed endpoint, indicating residual vulnerable instances will remain targets for months.