Executive brief
A WordPress plugin that enables drag-and-drop file uploads in Elementor forms was vulnerable to arbitrary file upload attacks. Unauthenticated attackers could bypass file type validation and upload executable PHP files, leading to complete website compromise through remote code execution without any authentication required.
Technical details
The vulnerability is an arbitrary file upload flaw in the elementor_file_upload function caused by insufficient validation in the is_file_type_valid() function. The vulnerable code uses an attacker-controlled 'type' parameter as regex keys against a MIME allowlist, enabling blacklist bypass. Attackers craft malicious file extensions that are normalized to PHP extensions by sanitize_file_name(), allowing upload of executable files. The attack is network-accessible and requires no authentication or user interaction. Successful exploitation grants remote code execution on the affected server with web application privileges. A patch is available in versions after 1.6.0.
Affected products
- Add-ons.org Drag and Drop File Upload for Elementor Forms up to and including 1.6.0
Timeline
- 2026-09-10: disclosed