WORDPRESS · SEPTEMBER 2026 · EARLY WARNING

Drag and Drop File Upload for Elementor Forms Plugin Vulnerability Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
elementor forms (wordpress)
Patched version
Not yet available
CVE-2026-18351

A critical vulnerability has been reported in the Drag and Drop File Upload for Elementor Forms plugin for WordPress. Users of versions up to and including 1.6.0 are advised to take immediate action.

What happened

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is reportedly vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0. This vulnerability allows unauthenticated attackers to upload files that may be executable, enabling remote code execution. The vulnerability is currently under investigation and no exploitation in the wild has been confirmed.

This issue poses a significant risk as it can lead to unauthorized access and potential compromise of the affected WordPress sites. It is crucial for users to assess their exposure and apply necessary mitigations to secure their environments.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If elementor forms is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using the Drag and Drop File Upload for Elementor Forms plugin for WordPress and your version is 1.6.0 or earlier, you are potentially affected.

What should I do right now?

Immediately upgrade the plugin to a version beyond 1.6.0 and review all uploaded files for any suspicious activity.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats