Update Elementor Pro, Plus 2 Tech Stories
Saturday’s news is a useful reminder that severity scores only tell part of the story. One critical WordPress plugin flaw needs site owners to actually do something. Microsoft disclosed an even higher-scoring Entra ID bug that customers cannot patch because Microsoft already fixed it in the cloud. And TikTok agreed to a $400 million children’s-privacy settlement where the biggest number in the headline still does not equal a court finding of liability.
If you run Elementor Pro, check the version now
Elementor Pro through version 4.2.1 has a critical file-upload vulnerability, CVE-2026-32475, that can let an unauthenticated visitor upload a malicious file and, under the right conditions, execute code on the server. The fix is in Elementor Pro 4.2.2, released August 19.
The 9.0 severity score is appropriately ugly, but the prerequisites matter. CERT.LV says the affected site needs a published page using Elementor Pro’s Form widget, at least one file-upload field, and that upload field must not be marked required. Under a specially crafted request, Elementor’s validation can stop checking files too early, letting a later upload slip past normal extension and MIME-type checks.
That is where “somebody uploaded the wrong kind of file” can turn into “somebody may own the website.” If the server executes the uploaded file, an attacker could potentially run code as the web server, plant a backdoor, alter the site, steal data or use the machine for something that has absolutely nothing to do with your contact form.
The practical answer is simple: update Elementor Pro to 4.2.2 or newer. Back up the site first and keep Elementor and Elementor Pro on compatible versions. If a public form accepted file uploads while the site was running an affected version, I would also inspect the uploads and filesystem for anything that does not belong there.
This is also why “it is just a form plugin” is not really a useful security category. A form that accepts files is accepting files from strangers and placing them on your server. That can be perfectly reasonable functionality. It is still a door from the internet into the business, and doors deserve locks that work.
Compromised website help
Sometimes maintenance starts after the damage is done. Raymond Tec can investigate compromised sites, clean up access, recover what can be recovered, and patch the original problem — then help make the next incident considerably less exciting.
Microsoft disclosed a severity-10 Entra ID flaw — after fixing it
Microsoft disclosed CVE-2026-69836, a maximum-severity vulnerability in Entra ID, the cloud identity system behind Microsoft 365, Azure and a lot of business sign-ins. Microsoft’s initial advisory marked the flaw as exploited. On August 22, Microsoft corrected that field to “No” and said the vulnerability was not exploited in the wild. It remains fully mitigated, and there is no customer action required.
The bug was a deserialization flaw that could allow an unauthorized attacker to execute code over a network. In plain English, the service could be tricked into processing attacker-controlled data as though it were safe.
Normally “10.0 remote code execution” is where I tell you to stop reading and patch something. Not here. Entra ID is Microsoft’s hosted infrastructure, so Microsoft owned the vulnerable code and fixed it behind the curtain.
That changes the story materially, and I need to correct yesterday’s version of this brief: I repeated Microsoft’s original exploited status because that was the first-party information available at the time. Microsoft later said that status was wrong. The vulnerability was technically severe, but Microsoft now says it was not exploited in the wild. The practical guidance does not change — there is still no customer patch to install — but the factual distinction absolutely does. For Microsoft 365 customers, keep doing the identity basics that matter every day: MFA, sensible admin privileges, logging and removing unused accounts.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
TikTok will pay up to $400 million in a children’s privacy settlement
TikTok and ByteDance agreed to pay as much as $400 million to settle a U.S. government lawsuit over children’s privacy. The Justice Department says TikTok will pay $300 million now and another $100 million if a court vacates an older consent decree involving Musical.ly, TikTok’s predecessor.
The lawsuit alleged that TikTok collected personal information from children under 13 without the parental consent required by COPPA and, in some cases, failed to delete children’s accounts and data when asked. Those are allegations. The Justice Department explicitly says the settlement is not a determination that TikTok is liable.
That distinction matters because settlements are not trial verdicts. We can say what the government alleged and what TikTok agreed to pay. We should not quietly convert one into proof of the other because $400 million makes a satisfying headline.
For parents, there is no new setting to change because of this settlement. The broader problem is that age gates remain a pretty flimsy way to protect children online. A box asking whether somebody is 13 is not much of a barrier when the person clicking it is 12.
For businesses and developers, the lesson is more concrete: if a service collects information from children, “we did not mean to” is not a privacy program. You need to know what you collect, what consent is required, how age restrictions are enforced and whether deletion requests actually work in the real system instead of only in the policy document.
That is probably the thread running through all three stories. The interesting part is not the giant severity score or giant settlement number. It is who actually has to act. Elementor site owners do. Entra ID customers do not have a patch to install. TikTok’s settlement changes the legal/compliance picture more than anyone’s Saturday-morning settings. Context is what turns an alarming number into useful information.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
Elementor Pro vulnerability
- CERT.LV: CVE-2026-32475 advisory
- Elementor Pro changelog
- Patchstack: Critical unauthenticated file upload to RCE in Elementor Pro
Microsoft Entra ID
- Microsoft Security Response Center: CVE-2026-69836
- BleepingComputer: Microsoft patches maximum-severity Entra ID flaw
