Drag And Drop File Upload For Elementor Forms Vulnerabilities

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'typ...

CVSS:

9.8

(Wordfence)

Affected:

up to 1.6.0

Fixed in:

1.6.1

Disclosed:

Sep 9, 2026

CVE-2026-18351 on NVD →

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remo...

CVSS:

9.8

(Wordfence)

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Aug 26, 2025

CVE-2025-49387 on NVD →

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the elementor_file_upload_remove() function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to delete arbitrary fi...

CVSS:

5.3

(Wordfence)

Affected:

up to 1.4.3

Fixed in:

1.5.0

Disclosed:

May 15, 2025

CVE-2025-47492 on NVD →