Executive Summary

A critical vulnerability (CVE-2026-18351) with a CVSS score of 9.8 exists in the Drag and Drop File Upload for Elementor Forms plugin for WordPress. This vulnerability allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. All versions up to and including 1.6.0 are affected.

Technical Analysis

The vulnerability is classified as an Arbitrary File Upload vulnerability. It exists in the elementor_file_upload function of the Drag and Drop File Upload for Elementor Forms plugin. The root cause is insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist. This allows for blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension.

How It Gets Exploited

An unauthenticated remote attacker sends a crafted file upload request to the vulnerable plugin's file upload endpoint. The attacker manipulates the 'type' parameter to bypass file type validation, allowing them to upload a file with a malicious PHP extension. Once uploaded, the attacker can execute the file, achieving remote code execution as the web service user. This could potentially allow the attacker to pivot to internal databases or other sensitive areas.

Impact Assessment

The Drag and Drop File Upload for Elementor Forms plugin for WordPress, versions up to and including 1.6.0, are affected. An attacker can achieve remote code execution, leading to high impacts on confidentiality, integrity, and availability. The CVSS score of 9.8 indicates a critical severity level.

Recommended Actions

Update the Drag and Drop File Upload for Elementor Forms plugin to a version later than 1.6.0. Implement a Web Application Firewall (WAF) rule to detect and block suspicious file upload requests. Monitor for unusual file upload activity and ensure that all uploaded files are thoroughly validated and scanned for malware.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence