CVE-2026-18351 in Drag and Drop File Upload for Elementor Forms Plugin
Summary
by MITRE • 09/10/2026
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within the Drag and Drop File Upload for Elementor Forms plugin affects all versions up to and including 1.6.0, representing a critical security flaw in WordPress environments utilizing this specific extension. The core of the issue lies in the elementor_file_upload function, which serves as the entry point for file processing operations initiated by users through form submissions or direct API calls. This vulnerability is classified under CWE-434, which describes an unrestricted upload of files with dangerous types, and aligns with MITRE ATT&CK technique T1505.003, specifically Server Side Web Shell Upload. The severity stems from the fact that it allows unauthenticated attackers to bypass standard security controls designed to prevent malicious file uploads on web servers.
The technical root cause is rooted in insufficient input validation within the is_file_type_valid function. This function attempts to enforce a MIME type allowlist by utilizing attacker-controlled data from the 'type' parameter as regex keys for matching against allowed content types. The implementation flaw allows an adversary to craft specific file extensions that, when processed through this logic, evade detection mechanisms intended to block executable scripts. Specifically, the validation process fails to adequately sanitize or strictly validate the extension before it is used in the regular expression evaluation. This oversight creates a path where malicious payloads can be disguised as benign files during the initial check phase, effectively tricking the application into accepting them as valid uploads based on manipulated metadata rather than actual file content analysis.
The operational impact of this vulnerability is severe, leading directly to remote code execution capabilities for any unauthenticated user interacting with the vulnerable endpoint. Once a crafted executable file bypasses the flawed validation logic and passes through the sanitize_file_name function, it undergoes normalization that may inadvertently convert or preserve an extension recognized by the web server as executable PHP code. Upon successful upload, these files are stored in accessible directories on the target system. An attacker can then request execution of this uploaded script via HTTP requests, gaining full control over the underlying operating system processes associated with the web application user account. This level of access typically allows for data exfiltration, further malware deployment, lateral movement within the network infrastructure, and complete compromise of the WordPress site's integrity and confidentiality.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary recommendation is to upgrade the Drag and Drop File Upload plugin to a version later than 1.6.0 where this specific validation logic has been corrected by the developers. In instances where upgrading is not immediately feasible, administrators should implement strict file type restrictions at the web server level rather than relying solely on application-level checks. Configuring Apache or Nginx to deny execution permissions for upload directories can significantly reduce the impact of successful uploads. Additionally, deploying a Web Application Firewall with rulesets tuned to detect common PHP shell patterns and anomalous POST requests containing binary data in form fields can provide an additional layer of defense against exploitation attempts until patches are applied.