Arbitrary File Upload Vulnerability in Drag and Drop File Upload for Elementor Forms Plugin by WordPress

CVE-2026-18351

What is CVE-2026-18351?

The Drag and Drop File Upload for Elementor Forms plugin for WordPress contains a vulnerability that allows arbitrary file uploads due to inadequate file type validation. Exploitation of the issue occurs via the elementor_file_upload function, where the is_file_type_valid() method improperly validates the file type based on an attacker-controlled parameter. This insufficient validation permits attackers to bypass the MIME allowlist by crafting malicious file extensions, leading to potential remote code execution exploits. As a result, unauthenticated users can upload potentially harmful executable files, compromising site security.

References