Drag and Drop File Upload for Elementor Forms Plugin Vulnerability Alert
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- elementor forms (wordpress)
- Patched version
- Not yet available
A critical vulnerability has been reported in the Drag and Drop File Upload for Elementor Forms plugin for WordPress. Users of versions up to and including 1.6.0 are advised to take immediate action.
What happened
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is reportedly vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0. This vulnerability allows unauthenticated attackers to upload files that may be executable, enabling remote code execution. The vulnerability is currently under investigation and no exploitation in the wild has been confirmed.
This issue poses a significant risk as it can lead to unauthorized access and potential compromise of the affected WordPress sites. It is crucial for users to assess their exposure and apply necessary mitigations to secure their environments.
What to do about it
- Upgrade the Drag and Drop File Upload for Elementor Forms plugin to a version beyond 1.6.0.
- Review all uploaded files for any suspicious activity.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
How 0Day would have caught this
elementor forms is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Drag and Drop File Upload for Elementor Forms plugin for WordPress and your version is 1.6.0 or earlier, you are potentially affected.
What should I do right now?
Immediately upgrade the plugin to a version beyond 1.6.0 and review all uploaded files for any suspicious activity.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.