External risk intelligence

Drag and Drop File Upload for Elementor Forms Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-49387

This vulnerability affects a WordPress plugin designed for form handling. Plugins of this type are commonly deployed on public-facing websites to enable user interactions, making the upload functionality directly reachable via the internet as part of the standard web application surface.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a common WordPress form add-on, allowing attackers to upload malicious code to a web server without any authentication. This could potentially lead to a complete compromise of the affected website.

Malicious code can be uploaded to websites.
This impacts public-facing websites using the add-on.
Confirm if this specific add-on is in use.

Attack Path

How an attacker could exploit the issue

An attacker can upload a web shell to a web server by exploiting an unrestricted file upload vulnerability in the Drag and Drop File Upload for Elementor Forms plugin. This allows them to execute arbitrary code on the server, potentially leading to a complete compromise of the affected website.

Publicly accessible website with the plugin installed.
Uploading a specially crafted file through the form.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Drag and Drop File Upload for Elementor Forms plugin could allow an attacker to upload a web shell to a web server when the plugin is used to handle form submissions. This could lead to the compromise of the server.

Web server files.
Unrestricted file upload via forms.
Server compromise and data breaches.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Drag and Drop File Upload for Elementor Forms plugin allows an unauthenticated attacker to upload a web shell. Application owners and platform teams responsible for WordPress instances should prioritize identifying affected sites, confirming exposure, and planning remediation.

Ownership: Application and platform teams.
Verify: Publicly accessible websites with the plugin.
Action: Assess risk, plan vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drag and Drop File Upload for Elementor Forms plugin?

This software is a WordPress plugin used to add file upload capabilities to Elementor-based forms. It allows website visitors to attach files directly to form submissions, which are then processed and stored by the WordPress server. Developers and site administrators typically install this add-on to streamline document collection or user-submitted media on their websites.

How would you describe the CVE-2025-49387 vulnerability?

This vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). In plain terms, the plugin fails to properly verify or restrict the types of files users can upload through the form. Because it lacks these security filters, an attacker can intentionally upload malicious scripts—specifically web shells—which the server then saves and makes accessible for execution.

Do I need to be logged in for an attacker to trigger this bug?

No, authentication is not required to trigger this vulnerability. The flaw exists in the way the plugin handles file processing requests, allowing anyone with access to the form to upload a file. The bug is specifically triggered by the submission of a malicious file through the plugin's upload function; it does not occur through standard, non-malicious usage where only expected file types are submitted.

Why is this plugin considered a risk for my public-facing website?

According to Halo Surface Signal, this plugin is designed for public interaction, meaning its upload functionality is inherently reachable via the internet. Because the feature is exposed to anyone visiting your site, the risk is elevated. If your website uses this plugin and is publicly accessible, it provides an open pathway for an external attacker to interact with your server without needing authorized access.

How should I handle the risk of this vulnerability on my server?

Start by identifying all WordPress instances where this specific plugin is active. Once identified, evaluate if the file upload feature is essential for your current operations. If it is not required, disable or remove the plugin immediately to close the attack path. If you must keep it, coordinate with your team to monitor for updates or official guidance from the plugin vendor to secure the file handling process.

References

patchstack.com/database/Wordpress/Plugin/drag-and-drop-file-upload-f…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.