Drag and Drop File Upload for Elementor Forms

CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms, a WordPress plugin that adds drag-and-drop upload fields to Elementor forms. Patchstack published the issue on September 9, 2026, and Wordfence Intelligence lists it as CVSS 9.8 critical.

The vulnerable upload path is reachable without authentication. The issue is weak file type validation in the upload handler: attacker-controlled type data can be used during validation and can allow a dangerous file extension to pass checks before WordPress normalizes the final file name.

Affected versions

• Plugin: Drag and Drop File Upload for Elementor Forms
• Slug: drag-and-drop-file-upload-for-elementor-forms
• Affected: versions up to and including 1.6.0
• Patched: 1.6.1
• Required privilege: unauthenticated
• Impact: arbitrary file upload, potentially leading to remote code execution where uploaded PHP is executable

Immediate remediation

• Update to version 1.6.1 or later.
• If a public upload form uses this plugin and you cannot update immediately, disable the plugin or remove the upload field until patched.
• Block PHP execution in wp-content/uploads at the web server level.
• Review uploads created since the plugin was exposed, especially files with PHP-like extensions or double extensions.
• Check for unknown administrator accounts, suspicious mu-plugins, and recently modified theme/plugin files.

WP-CLI checks

wp plugin get drag-and-drop-file-upload-for-elementor-forms --fields=name,status,version,update_version --format=table
wp plugin update drag-and-drop-file-upload-for-elementor-forms
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp db query "SELECT ID, post_date, guid FROM {prefix}posts WHERE post_type='attachment' AND guid REGEXP '\\.(php|phtml|phar|shtml)(\\.|$)' ORDER BY post_date DESC LIMIT 50;"

Block PHP execution in uploads

On Apache/LiteSpeed, add this to wp-content/uploads/.htaccess if your host allows it:

<FilesMatch '\.(php|phtml|phar|shtml)$'>
    Require all denied
</FilesMatch>

On Nginx, use a server-level rule similar to this:

location ~* /wp-content/uploads/.*\.(php|phtml|phar|shtml)$ {
    deny all;
}

Sources

• Patchstack advisory
• Wordfence Intelligence record
• WordPress.org plugin page
• CVE-2026-18351