EUVD-2026-60891
GHSA-f29r-mh79-f49q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted request to upload endpoint
-
ExploitBypass file-type validation (CWE-434)
-
ExecutionWrite PHP webshell to web root
-
PersistRequest uploaded file to execute code
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The site must run the Piotnet Addons For Elementor Pro plugin at version 7.1.67 or earlier with its vulnerable upload functionality reachable over the network. No authentication is required (CVSS PR:N), so any exposed installation is a candidate. The CVSS vector marks UI:R, implying some user interaction may be needed to complete the attack, though the 'Unauthenticated Arbitrary File Upload' description suggests the endpoint may be directly callable - this should be verified against the Patchstack advisory. The principal limiting factor is simply having the plugin installed and active at an affected version; there is no indication a non-default configuration is required. |
| Impact | This is a genuine high-priority issue rather than an inflated high-CVSS number. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) shows a network-reachable, low-complexity, unauthenticated flaw with high impact across confidentiality, integrity, and availability plus a scope change - the hallmark profile of upload-to-RCE bugs. Note one internal tension worth verifying with the vendor: the vector requires user interaction (UI:R), yet the description labels the bug simply 'Unauthenticated Arbitrary File Upload,' which usually implies a directly reachable endpoint needing no interaction; defenders should not assume UI:R meaningfully limits exploitation. EPSS data was not provided and the CVE is not in CISA KEV, and no POC was supplied, so there is no evidence of active or automated exploitation yet - but arbitrary file upload flaws in WordPress plugins are historically weaponized quickly once disclosed, so any operator running this plugin should treat it as urgent and patch on an emergency timeline rather than waiting for exploitation signals. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running Piotnet Addons For Elementor Pro <= 7.1.67 and sends a request to the plugin's unauthenticated upload handler carrying a malicious PHP file. The server stores the file in a web-accessible location; the attacker then requests it directly to execute code, establishing a webshell and taking over the site. No credentials are required (PR:N), and complexity is low (AC:L); no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
RemediationAI
Upgrade Piotnet Addons For Elementor Pro to the first release above 7.1.67 as published by the vendor; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/piotnet-addons-for-elementor-pro/vulnerability/wordpress-piotnet-addons-for-elementor-pro-plugin-7-1-67-arbitrary-file-upload-vulnerability) and the Piotnet vendor changelog for the exact fixed version, as no specific patched version is confirmed in the provided data. If a patch cannot be applied immediately, deactivate and remove the plugin, or use a WAF/virtual-patching rule (Patchstack offers one) to block requests to the vulnerable upload endpoint - accepting that deactivation will disable any Piotnet-dependent page elements. As additional compensating controls, configure the web server to deny execution of PHP within WordPress upload/media directories (e.g. an .htaccess or nginx location rule blocking script execution under wp-content/uploads), which neutralizes the webshell payload with minimal functional side effects, and audit upload directories for recently added unexpected files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Piotnet Addons For Elementor Pro, a commercial add-on that extends the widely-used Elementor page builder for WordPress (CPE: cpe:2.3:a:piotnet:piotnet_addons_for_elementor_pro:*). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler fails to properly validate file type, extension, or content, allowing a PHP or other executable file to be written into a web-accessible directory. In a PHP/WordPress context this is especially dangerous because an uploaded .php file placed under the web root can be requested directly and executed by the server, converting an upload primitive into remote code execution.
Know when Piotnet Addons For Elementor Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Unauthenticated network-reachable upload leading to code execution gives AV:N/AC:L/PR:N with full C/I/A impact; I assess UI:N as file-upload endpoints are typically directly callable, differing from the input's UI:R.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
Executive ViewAI
The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤7.1.67) contains an unauthenticated file upload vulnerability (CVE-2026-28192, CVSS 9.6) enabling remote attackers to deploy webshells and achieve complete site takeover. No public exploit has been identified at time of analysis; however, the lack of authentication requirements means any exposed WordPress installation running this plugin is an immediate target. No vendor patch is currently available, requiring urgent interim mitigation.
Immediate interim mitigations: (1) Disable or remove the plugin on all affected sites; (2) Deploy Web Application Firewall (WAF) blocking POST requests to /wp-content/plugins/piotnet-addons* upload directories; (3) Configure WordPress file upload restrictions to prevent dangerous file types (.php, .phtml, .php5, .pht, etc.); (4) Enable detailed logging and alerting on all file creation events in plugin directories; (5) Restrict filesystem write permissions on plugin directories to minimum required; (6) Establish daily backup testing to enable rapid restoration if compromise occurs. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB