The plugin contains an unrestricted upload condition that permits an attacker to upload files with dangerous types to the web server. An attacker can inject a web shell, which could be used to gain remote execution and complete compromise of the site. The weakness is consistent with CWE-434 where the system fails to validate or filter uploaded content. Exposure could allow an attacker to exfiltrate data, deface the site, or use the server for malicious purposes.

Add-ons.org’s Drag and Drop File Upload for Elementor Forms is affected. Any installation using versions from the initial release through 1.5.3 is vulnerable. Versions >=1.5.4 are not listed as affected.

The CVSS score of 10 indicates a critical severity. The EPSS score of < 1% reflects a very low probability of exploitation in the wild, yet the risk of a credentialed or post‑authentication upload remains high because the attack requires access to the form submission mechanism. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its potential to deliver a web shell warrants prompt action. The likely attack vector is via the Elementor form interface using legitimate upload capabilities.