{"id":"CVE-2026-18351","aliases":["EUVD-2026-75227","GHSA-fh47-jv9w-x723"],"status":"published","title":"Drag and Drop File Upload for Elementor Forms \u003c= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter","description":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01132,"percentile":0.66863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2026-09-10T01:26:54Z","modified":"2026-09-10T14:39:13Z","exploits":[{"source":"pocgithub","id":"ChiefYoru/Exploit-CVE-2026-18351","title":"ChiefYoru/Exploit-CVE-2026-18351","date":"2026-09-11","url":"https://github.com/ChiefYoru/Exploit-CVE-2026-18351"}],"products":[{"vendor":"add-ons.org","product":"drag and drop file upload for elementor forms"},{"vendor":"addonsorg","product":"drag and drop file upload for elementor forms"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12?source=cve"},{"url":"https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/drag-and-drop-file-upload-for-elementor-forms.php"},{"url":"https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php"},{"url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php#L833"},{"url":"https://plugins.trac.wordpress.org/changeset/3628051/drag-and-drop-file-upload-for-elementor-forms"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18351"},{"url":"https://github.com/advisories/GHSA-fh47-jv9w-x723"}],"sources":{"cve":[{"id":"CVE-2026-18351","title":"Drag and Drop File Upload for Elementor Forms \u003c= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter","description":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","status":"published","published":"2026-09-10T01:26:54.181Z","modified":"2026-09-10T11:18:32.534Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-75227","description":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","status":"published","published":"2026-09-10T01:26:54Z","modified":"2026-09-10T11:18:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:25.63332Z"}],"ghsa":[{"id":"GHSA-fh47-jv9w-x723","title":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary...","description":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","status":"published","published":"2026-09-10T03:30:20Z","modified":"2026-09-10T03:30:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:11:40.819612Z"}],"nvd":[{"id":"CVE-2026-18351","description":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","status":"published","published":"2026-09-10T02:16:34.18Z","modified":"2026-09-10T14:39:13.757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}