Unauthenticated Remote Code Execution in Drag and Drop File Upload for Elementor Forms

The Drag and Drop File Upload for Elementor Forms WordPress plugin, version 1.6.0 and earlier, contains a critical arbitrary file upload vulnerability tracked as CVE-2026-18351. The vulnerability exists within the 'is_file_type_valid()' function, which improperly handles the 'type' parameter during file uploads. Specifically, the function uses this attacker-controlled parameter as a regex key when checking against MIME type allowlists. By crafting a request that influences this logic, an unauthenticated attacker can bypass existing file type restrictions. The 'sanitize_file_name()' function subsequently normalizes the filename, potentially converting a manipulated input into a executable PHP script. If successfully exploited, this flaw allows for unauthenticated remote code execution on the underlying WordPress server. Defenders should identify instances of this plugin in their environment and ensure they are patched beyond version 1.6.0.

Attack Chain

1. Attacker performs reconnaissance to identify sites running the vulnerable Drag and Drop File Upload for Elementor Forms plugin.
2. Attacker crafts an HTTP POST request targeting the 'elementor_file_upload' function endpoint.
3. Attacker injects a malicious payload into the 'type' parameter to subvert the 'is_file_type_valid()' regex validation logic.
4. Attacker uploads a file with a double extension or normalized name that bypasses the MIME type allowlist.
5. The plugin's 'sanitize_file_name()' function normalizes the malicious filename into an executable PHP file.
6. The web server saves the attacker-supplied PHP file to a publicly accessible directory.
7. Attacker requests the uploaded PHP file via the web browser to trigger remote code execution.

Impact

Successful exploitation of CVE-2026-18351 enables unauthenticated remote code execution. This can lead to full site compromise, data exfiltration, installation of webshells for persistence, and further lateral movement within the hosting infrastructure.

Recommendation

1. Immediately update the Drag and Drop File Upload for Elementor Forms plugin to the latest available version beyond 1.6.0.
2. Audit web server logs for HTTP POST requests to the 'elementor_file_upload' endpoint containing irregular 'type' parameters or attempts to upload .php, .phtml, or .php5 files.
3. Implement Web Application Firewall (WAF) rules to inspect and block requests containing suspicious MIME type strings or file upload attempts from unauthorized or non-standard sources.
4. Use file integrity monitoring to detect the creation of new, unexpected files in plugin-associated upload directories.