EUVD-2026-60891
GHSA-f29r-mh79-f49q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Unauthenticated network-reachable upload leading to code execution gives AV:N/AC:L/PR:N with full C/I/A impact; I assess UI:N as file-upload endpoints are typically directly callable, differing from the input's UI:R.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
AnalysisAI
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The site must run the Piotnet Addons For Elementor Pro plugin at version 7.1.67 or earlier with its vulnerable upload functionality reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated high-CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Piotnet Addons For Elementor Pro to the first release above 7.1.67 as published by the vendor; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/piotnet-addons-for-elementor-pro/vulnerability/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-67-arbitrary-file-upload-vulnerability) and the Piotnet vendor changelog for the exact fixed version, as no specific patched version is confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately identify all WordPress instances using Piotnet Addons For Elementor Pro by version audit; disable or remove the plugin on all sites running version 7.1.67 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today