Elementor Forms Upload EUVD-2026-75227

The target site must run the Drag and Drop File Upload for Elementor Forms plugin (version ≤1.6.0) and expose at least one Elementor form using its drag-and-drop file upload field so the elementor_file_upload handler is reachable. Exploitation requires no authentication, no user interaction, and works against default plugin behavior - the attacker only needs to supply a crafted 'type' parameter and a filename that sanitize_file_name() normalizes into a PHP extension. The main limiting factor is that a form with the upload field must actually be published/reachable, and server-side controls that forbid PHP execution in the upload directory would blunt the RCE outcome.

All primary signals point to genuine high risk rather than an inflated CVSS score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects unauthenticated, low-complexity, remote exploitation with full confidentiality, integrity, and availability impact, and the described logic flaw (attacker-controlled regex keys plus filename normalization) is straightforward to weaponize into a webshell. This is a WordPress plugin file-upload-to-RCE, a heavily targeted class historically favored by automated exploitation and mass campaigns. No EPSS score, KEV listing, or POC was provided in the input, so exploitation is not yet confirmed in the wild; however, the low technical barrier and Wordfence's threat-intel disclosure mean opportunistic scanning is plausible. No conflicting signals were observed between the CVSS vector and the description - both agree on unauthenticated network access.

An unauthenticated attacker locates a public WordPress page containing an Elementor form with the drag-and-drop upload field, then submits a POST to the elementor_file_upload endpoint with a crafted 'type' parameter and a filename engineered so sanitize_file_name() yields a .php extension, bypassing the MIME allowlist. The resulting PHP webshell is written into the web root and requested directly, giving the attacker arbitrary code execution on the host. Given AV:N/AC:L/PR:N/UI:N, this can be fully automated at scale, though no POC was provided in the input.