{"id":"CVE-2026-18351","title":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function","summary":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type valid…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"addonsorg","product":"Drag and Drop File Upload for Elementor Forms","affected":["drag_and_drop_file_upload_for_elementor_forms <= 1.6.0"],"published":"2026-09-10","updated":"2026-09-10","sourceUpdated":"2026-09-10T14:39:13.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18351","references":[{"url":"https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/drag-and-drop-file-upload-for-elementor-forms.php","label":"security@wordfence.com"},{"url":"https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php#L833","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3628051/drag-and-drop-file-upload-for-elementor-forms","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12?source=cve","label":"security@wordfence.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T11:16:54.641277Z"},"ingestedAt":"2026-09-10T02:28:59.310Z","epss":0.00768,"epssPercentile":0.53602,"exploits":{"github":2,"githubRepos":["https://github.com/JohenLastGen-JLG/CVE-2026-18351","https://github.com/ChiefYoru/Exploit-CVE-2026-18351"],"checkedAt":"2026-09-21T15:28:15.120Z"},"exploitAvailable":true,"slug":"CVE-2026-18351","body":"## Overview\n\nThe Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}