CVE-2026-18351
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to and including 1.6.0. The flaw stems from insufficient file type validation, letting attackers upload files that can be executed on the server. This can lead to remote code execution without any authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the Drag and Drop File Upload for Elementor Forms plugin, specifically versions 1.6.0 and earlier.
Real-world impact
An attacker can upload a malicious file that the server will execute, giving the attacker full control over the website, allowing data theft, site defacement, or further attacks on the server.
Why this severity
The CVSS score of 9.8 reflects a network‑based attack that requires no privileges or user interaction, and it grants the attacker complete confidentiality, integrity, and availability compromise. The vulnerability’s ability to execute arbitrary code makes it a critical threat.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources