The Drag and Drop File Upload for Elementor Forms plugin is affected by a critical arbitrary file upload vulnerability that allows unauthenticated attackers to execute arbitrary code on the host server.

This vulnerability occurs within the elementor_file_upload function, where insufficient validation of the type parameter allows attackers to bypass MIME allowlist checks. An unauthenticated attacker can upload malicious files that are subsequently normalized to PHP extensions, facilitating remote code execution.

The exploitation of this vulnerability poses a severe risk to organizational security, as it grants unauthenticated actors the ability to execute arbitrary code on the underlying web server. With a CVSS score of 9.8, this flaw represents a critical risk of full system compromise, unauthorized data access, and potential lateral movement within the network. Immediate remediation is required to prevent total loss of integrity and confidentiality for the affected WordPress environment.

Immediate Action: Update the Drag and Drop File Upload for Elementor Forms plugin to version 1.6.1 or later to implement the necessary file validation patches.

Proactive Monitoring: Review web server access logs for requests targeting the elementor_file_upload endpoint, specifically monitoring for unusual file extensions or unexpected POST requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to the file upload handler if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability and the ease of exploitation by unauthenticated attackers, organizations must prioritize patching this plugin immediately. Failure to update to version 1.6.1 leaves the WordPress environment exposed to complete system takeover. Security teams should verify that all installations are updated and audit the server for any suspicious files that may have been uploaded prior to the patch application.