PoC Index85,100 CVEs with PoCs

CVE-2026-18351

Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

CRITICAL 9.8EPSS 1.0%

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Affected
addonsorg · Drag and Drop File Upload for Elementor Forms
CVSS v3.1 WORDFENCE
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.05% chance of exploitation in the next 30 days, 64th percentile
Published
2026-09-10

Proof-of-concept exploits (2)

References

Related