Drag And Drop File Upload For Elementor Forms Vulnerabilities

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remo...

CVSS:

9.8

Affected:

up to 1.5.3

Fixed in:

1.5.4

Disclosed:

Aug 26, 2025

CVE-2025-49387 on NVD →

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the elementor_file_upload_remove() function in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to delete arbitrary fi...

CVSS:

5.3

Affected:

up to 1.4.3

Fixed in:

1.5.0

Disclosed:

May 15, 2025

CVE-2025-47492 on NVD →