Description

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-10T02:16:34.180Z",
  "pubdate": "2026-09-10T02:16:34.180Z",
  "executiveSummary": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress, up to and including version 1.6.0, is affected by a critical arbitrary file upload vulnerability. This security weakness resides within the elementor_file_upload function and stems from a logical flaw in how file types are validated.\nAn unauthenticated remote attacker can exploit this weakness to bypass file extension restrictions and upload malicious files, such as PHP scripts, directly to the target server. Because these uploaded files can be executed on the server, the vulnerability directly leads to remote code execution (RCE).\nThis allows an attacker to fully compromise the underlying WordPress web server, potentially leading to unauthorized data access, website defacement, or lateral movement within the hosting environment. Exploitation requires no authentication or specific user interaction, representing a severe risk to affected installations. Organizations utilizing this plugin must take immediate action to mitigate the risk and secure their environments against unauthorized system access.",
  "technicalDetails": "The vulnerability lies within the elementor_file_upload function of the Drag and Drop File Upload for Elementor Forms plugin. The root cause of this security issue is located in the validation logic implemented within the is_file_type_valid() function. When a file is uploaded, the plugin attempts to verify whether the file extension and MIME type match an allowed list. However, the validation mechanism relies on the attacker-controlled 'type' parameter as keys for a regular expression mapping within the MIME allowlist.\nBecause the plugin uses this user-supplied 'type' parameter directly in regex matching, an attacker can manipulate this parameter to inject custom regular expression patterns. This manipulation allows the validation check to succeed even when the file possesses a prohibited extension. Once the validation check is bypassed, the plugin processes the file name using the WordPress built-in sanitize_file_name() function to sanitize the final file name before saving it.\nDuring this sanitization phase, sanitize_file_name() removes or normalizes specific special characters. An attacker can craft a file name with special characters or specific extensions that, prior to sanitization, bypass the validation check, but after being processed through sanitize_file_name(), resolve to a standard PHP extension (such as .php).\nThe execution flow for this exploit proceeds as follows: First, the unauthenticated attacker prepares a malicious payload containing PHP code, such as a web shell designed to execute arbitrary commands. Second, the attacker crafts an HTTP POST upload request targeting the elementor_file_upload endpoint. In this request, they supply a modified 'type' parameter to subvert the regex keys used in is_file_type_valid(). Third, the attacker names the payload file in a manner that bypasses initial checks but resolves to an executable PHP extension post-sanitization.\nFourth, the plugin validates the spoofed MIME type and executes sanitize_file_name(), which normalizes the file name to an executable format. Fifth, the file is successfully written to a publicly accessible directory on the web server. Sixth, the attacker requests the uploaded PHP file directly via its URL, triggering server-side execution of the payload and achieving complete Remote Code Execution (RCE).\nThis critical flaw affects all versions of the plugin up to and including 1.6.0. Since no authentication or special privileges are required to access the file upload handler, any external actor can exploit this vulnerability, potentially gaining full control over the underlying operating system hosting the WordPress instance."
}