External risk intelligence

Elementor Forms Arbitrary File Upload Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18351

This vulnerability exists in a WordPress plugin designed to handle file uploads via web forms. As a public-facing website component, it is reachable by default over the internet to any visitor, making the upload functionality an intentionally exposed network service.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin that allows file uploads through forms. This flaw, present in all versions up to 1.6.0, could permit unauthenticated attackers to upload and execute arbitrary files, potentially leading to remote code execution on affected websites. The main concern is confirming relevance and exposure.

Flaw allows uploading and running malicious files.
Critical issue affects public-facing website forms.
Confirm if this plugin is used and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted file through a website's form. The plugin incorrectly validates file types, allowing malicious files to be uploaded. If successful, this could allow an attacker to execute arbitrary code on the server, potentially leading to a full compromise of the website.

Unauthenticated access to web form required.
Upload a malicious file with a crafted extension.
Remote code execution is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload and execute arbitrary files on a WordPress site. This is possible due to insufficient validation of file types, which attackers can bypass by using a crafted file extension.

Potentially executable files on the system.
Upload via a crafted file extension.
Remote code execution on the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Drag and Drop File Upload for Elementor Forms plugin's arbitrary file upload vulnerability requires immediate attention. This issue, present in all versions up to 1.6.0, allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. Action will likely involve WordPress administrators, platform teams managing the web hosting environment, and potentially security teams for incident response. The first practical step is to identify all WordPress instances using this plugin, confirm their exposure, and then engage the accountable owner to plan remediation.

WordPress administrators own this issue.
Verify plugin usage and external reachability.
Coordinate vendor update or disable the plugin.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Drag and Drop File Upload for Elementor Forms plugin?

It is a WordPress plugin that adds file upload functionality to web forms created with the Elementor page builder. Website owners use it to allow visitors to submit documents, images, or other files directly through their site's contact or submission forms.

How does CVE-2026-18351 allow remote code execution?

This vulnerability is an Unrestricted Upload of File with Dangerous Type (CWE-434). The plugin fails to properly check file extensions during upload. An attacker can manipulate the file type settings to bypass security checks, allowing them to upload a file that the server treats as an executable script rather than a simple document.

Do I need to be logged in to trigger this vulnerability?

No. The flaw exists within the public-facing upload function of the plugin. An attacker does not need an account or administrative access to the WordPress site to send a crafted file to the server and attempt to trigger the code execution process.

Why is this plugin considered externally exposed?

According to Halo Surface Signal, because this plugin powers file uploads on public web forms, it is designed to be accessible to anyone on the internet. This creates an open pathway for attackers to reach the vulnerable upload function without requiring any internal network access.

What is the first step to address this CVE?

Your priority is to conduct an audit to see if you have this specific plugin installed on any WordPress sites. If you confirm usage, verify if the site is reachable from the internet. If you find the plugin, disable it immediately and look for an official update from the vendor to resolve the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.