Description
The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
Published: 2026-05-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The plugin allows unauthenticated users to upload files through the form builder because the file type validation is incomplete. Only a limited set of extensions is blocked, leaving dangerous extensions such as .phar or .phtml able to be uploaded. When such a file is stored on the server it can be executed, leading to remote code execution.

Affected Systems

Any WordPress installation using Piotnet Addons For Elementor Pro version 7.1.70 or earlier is affected. The vulnerability exists in all releases up to and including 7.1.70.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical flaw. EPSS is not available, so the actual likelihood of exploitation is unknown, but the flaw is listed as not yet in the CISA KEV catalog. An attacker only needs to submit a form containing a file field, which is unauthenticated. The missing validation allows the upload of files that can be executed by the server, making this a high‑risk, easy‑to‑exploit vulnerability.

Generated by OpenCVE AI on May 19, 2026 at 08:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Piotnet Addons For Elementor Pro to a version newer than 7.1.70, which includes the needed file type validation that addresses the CWE‑434 issue.
  • If an immediate update is not possible, temporarily remove or disable all file upload fields from your Elementor forms until the plugin is patched.
  • Configure server‑level rules such as a .htaccess directive to disable PHP execution in the upload directory, ensuring that even if files are uploaded, they cannot be executed, which mitigates CWE‑434.
  • If no patch is available, apply file system permissions or dedicated upload directories with restricted execution rights to prevent potential remote code execution, further mitigating the CWE‑434 vulnerability.

Generated by OpenCVE AI on May 19, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 19 May 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 19 May 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
Title Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-19T12:28:10.186Z

Reserved: 2026-03-26T09:27:18.254Z

Link: CVE-2026-4885

cve-icon Vulnrichment

Updated: 2026-05-19T12:28:06.737Z

cve-icon NVD

Status : Deferred

Published: 2026-05-19T08:16:16.223

Modified: 2026-05-19T14:38:39.660

Link: CVE-2026-4885

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-19T09:00:06Z

Weaknesses