Elementor Pro 4.2.2 closed an unauthenticated file upload (CVE-2026-32475)

A form with an upload field was enough for anyone to drop a PHP file into your uploads folder. What the flaw needed, which version fixes it, and the folder worth opening on any site that ran 4.2.1 or below.