Elementor Pro form file-upload array bypass with .php payload (CVE-2026-32475)

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•3

Detects a malicious HTTP POST request targeting the Elementor Pro WordPress plugin's 'elementor_pro_forms_send_form' action. The rule looks for a specific attempt to bypass file upload restrictions by manipulating the array index of form fields to upload a PHP file via the 'admin-ajax.php' endpoint.