EUVD-2026-75227
GHSA-fh47-jv9w-x723
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network upload with no user interaction (AV:N/AC:L/PR:N/UI:N) yields webshell RCE, giving full confidentiality, integrity, and availability impact on the host.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Articles & Coverage 2
AnalysisAI
Remote code execution in the Drag and Drop File Upload for Elementor Forms WordPress plugin (versions up to and including 1.6.0) allows unauthenticated attackers to upload executable PHP files through the elementor_file_upload handler. The is_file_type_valid() function trusts an attacker-controlled 'type' parameter as regex keys in its MIME allowlist, so a crafted extension bypasses the intended blacklist and is subsequently normalized to a .php extension by sanitize_file_name(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must run the Drag and Drop File Upload for Elementor Forms plugin (version ≤1.6.0) and expose at least one Elementor form using its drag-and-drop file upload field so the elementor_file_upload handler is reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All primary signals point to genuine high risk rather than an inflated CVSS score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects unauthenticated, low-complexity, remote exploitation with full confidentiality, integrity, and availability impact, and the described logic flaw (attacker-controlled regex keys plus filename normalization) is straightforward to weaponize into a webshell. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed release published in WordPress.org plugin changeset 3628051 (https://plugins.trac.wordpress.org/changeset/3628051/drag-and-drop-file-upload-for-elementor-forms); the input confirms an upstream fix but does not state an exact patched version number, so install the first release after 1.6.0 available in the plugin repository and confirm the version against the Wordfence advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Drag and Drop File Upload for Elementor Forms versions up to 1.6.0 and immediately disable the plugin or block the elementor_file_upload AJAX handler via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today