# CVE-2026-4885: Piotnet Addons for Elementor Pro arbitrary file upload in form builder

Source: https://junglewise.ai/threats/cve-2026-4885-piotnet-addons-for-elementor-pro-arbitrary-file-upload-in-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-4885 · Severity: critical · CVSS 9.8 · Published 2026-05-19

The Piotnet Addons for Elementor Pro plugin, a popular tool for building advanced forms and layouts in WordPress, contains a critical security flaw in its form builder component. This vulnerability allows an unauthenticated person to upload malicious files to the website's server if a file upload field is present on any form. An attacker could use this to take complete control of the website, potentially leading to data theft, site defacement, or a total service outage.

Vendors: [Piotnet](https://junglewise.ai/threats/vendors/piotnet).

## Quick answers

**Is CVE-2026-4885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4885 being exploited in the wild.

**How severe is CVE-2026-4885?** Critical severity, with a CVSS score of 9.8, published 19 May 2026.

**Which products and versions are affected?** Piotnet Addons for Elementor Pro Up to, and including, 7.1.70.

**Is there a fix for CVE-2026-4885?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4885 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4885?** Check whether you run Piotnet Addons for Elementor Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to an unrestricted file upload vulnerability within the 'pafe_ajax_form_builder' function. The root cause is an incomplete extension blacklist that filters common PHP extensions (php, phpt, php5, php7) and executables (exe) but fails to block dangerous alternatives like .phar or .phtml. An unauthenticated attacker can exploit this by submitting a form that includes a file upload field, uploading a malicious script, and then accessing it to achieve remote code execution (RCE). The vulnerability affects all versions up to and including 7.1.70.

## Affected products

- Piotnet Piotnet Addons for Elementor Pro Up to, and including, 7.1.70

## Timeline

- 2026-05-19: disclosed: CVE published to NVD
- 2026-05-19: advisory: Wordfence advisory published

## References

- [https://pafe.piotnet.com/](https://pafe.piotnet.com/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/ffff2ff3-769d-4eb2-acbe-d8ce6f042581?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/ffff2ff3-769d-4eb2-acbe-d8ce6f042581?source=cve)