Piotnet Addons For Elementor Pro
Monthly
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Unauthenticated arbitrary file upload in the Piotnet Addons for Elementor Pro WordPress plugin (versions through 7.1.70) allows remote attackers to upload dangerous file types and potentially achieve remote code execution. The flaw stems from an incomplete extension blacklist in the 'pafe_ajax_form_builder' AJAX handler that fails to block executable wrappers such as .phar and .phtml. No public exploit identified at time of analysis, but the CVSS 9.8 score and unauthenticated network attack vector make this a high-priority issue for any WordPress site running the plugin with a file-upload form field.
Unauthenticated arbitrary file upload in the Piotnet Addons For Elementor Pro WordPress plugin (versions <= 7.1.67) lets remote attackers upload files of dangerous types, a CWE-434 flaw that typically enables webshell deployment and full site takeover. The issue was reported by Patchstack and carries a critical 9.6 CVSS score; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Because exploitation requires no authentication, any exposed site running an affected version is a viable target.
Unauthenticated arbitrary file upload in the Piotnet Addons for Elementor Pro WordPress plugin (versions through 7.1.70) allows remote attackers to upload dangerous file types and potentially achieve remote code execution. The flaw stems from an incomplete extension blacklist in the 'pafe_ajax_form_builder' AJAX handler that fails to block executable wrappers such as .phar and .phtml. No public exploit identified at time of analysis, but the CVSS 9.8 score and unauthenticated network attack vector make this a high-priority issue for any WordPress site running the plugin with a file-upload form field.