AIKIDO-2026-839662

TL;DR

The Forms File Upload field validates extensions and moves files using two loops that treat empty entries differently. An empty first file part makes validation() return before type-checking later entries and process_field() only skips that empty entry and still moves a following .php upload into the public forms directory. An unauthenticated visitor who submits a form with a File Upload field can therefore place executable PHP under wp-content/uploads/elementor/forms/ and achieve remote code execution. The fix aligns both loops on empty entries and re-checks the extension inside process_field() before moving the file.