The plugin’s create_entry_el() routine reads the raw_value from an Elementor Pro upload field and passes it straight to PHP’s copy() without validating that the value corresponds to a legit uploaded file. When no file is present, raw_value can be set by an unauthenticated attacker in a crafted POST request; copy() accepts both local paths and URLs, allowing the attacker to read any file readable by the PHP process or to copy data from an arbitrary remote location into a hashed directory that is not reliably protected.

WordPress sites that run the crmperks Database for Contact Form 7, WPforms, Elementor Forms plugin version 1.5.1 or earlier and have Elementor Pro installed. The vulnerable code path is triggered by Elementor Pro, but the flaw resides in Contact Form Entries; updating the plugin beyond 1.5.1 removes the exposed path, while sites without Elementor Pro or using newer plugin versions are not affected.

With a CVSS score of 6.5 the vulnerability is moderate, and its EPSS score of less than 1 % indicates a low probability of exploitation in the wild at present; it is not listed in the CISA KEV catalog. An attacker can craft an unauthenticated POST request to the Elementor Pro form upload endpoint, injecting a raw_value that points to a server file or a remote URL. Because PHP’s copy() does not enforce validation, the attacker can disclose any file that the PHP process can read or copy arbitrary external data into the site.