CVE-2026-18351: Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitizefilename() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no WordPress account or user interaction is required. Exploitation targets the plugin's file-upload functionality.
What conditions are needed for exploitation?
The affected plugin must be installed at version 1.6.0 or earlier and its vulnerable upload handling must be reachable. An attacker can supply a crafted type parameter and filename extension to bypass file-type validation and cause the filename to be normalized to a PHP extension.
What is the likely impact of a successful upload?
An attacker may upload an executable file, which can lead to remote code execution. The stated impact includes complete compromise of confidentiality, integrity, and availability.
How can I tell whether my site is affected?
Check whether Drag and Drop File Upload for Elementor Forms is installed and whether its version is 1.6.0 or earlier. Sites running those versions should treat the plugin's elementor_file_upload functionality as vulnerable.