External risk intelligence

Piotnet Addons For Elementor Pro Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-28192

The vulnerability exists in a WordPress plugin used to extend website functionality. Such plugins are typically installed on web servers that are publicly accessible to render pages and interact with visitors, making the plugin's endpoints frequently reachable from the internet.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security flaw in Piotnet Addons For Elementor Pro, affecting how files are handled. The vulnerability allows for unauthenticated arbitrary file uploads, which could potentially lead to unauthorized access and manipulation of website content. The main concern is confirming the relevance and exposure of this specific plugin within our environment.

Unauthenticated file uploads are a serious security risk.
It allows unauthorized code execution on websites.
Assess plugin usage for potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can upload malicious files to a website by exploiting a vulnerability in the Piotnet Addons for Elementor Pro plugin. This can happen without the attacker needing any prior access or credentials, and it could lead to significant compromise of the website and its data.

No authentication required.
Triggered via file upload feature.
Risk of full site compromise.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated arbitrary file uploads could allow an attacker to upload malicious files to a website, potentially leading to unauthorized code execution. This could impact website integrity and availability when supported by the advisory.

Website files and server access.
Malicious file uploads by unauthenticated users.
Compromise of website functionality and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Piotnet Addons For Elementor Pro impacts web application owners and the platform or infrastructure teams managing the underlying WordPress environments. The initial step should be to identify all instances of this plugin, determine their exposure to the internet, and confirm which are business-critical before planning remediation.

Application and platform teams should own.
Verify plugin reachability and impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Piotnet Addons For Elementor Pro?

It is a WordPress plugin designed to extend the core Elementor page builder with additional widgets, features, and design capabilities. Website administrators install it to enhance site functionality and aesthetics. Because it integrates directly into the WordPress environment, it handles various data inputs and server-side processes, which can become security touchpoints if the plugin's code does not properly validate incoming requests.

What does CWE-434 mean for CVE-2026-28192?

This vulnerability is classified as an Unrestricted Upload of File with Dangerous Type. In plain English, the plugin fails to properly verify the files a user uploads through its interface. Because it lacks sufficient checks on file extensions or content, an attacker can upload malicious scripts instead of expected media files, which the server might then incorrectly accept and process.

How can an attacker trigger this file upload bug?

An attacker triggers this by interacting with the specific file upload functionality provided by the plugin. The core issue is that the system does not require any credentials to perform this action. It is important to note that merely visiting the website or having the plugin installed does not automatically trigger the vulnerability; it requires the attacker to actively submit a file through the vulnerable endpoint.

Is my site at risk if I use this plugin?

Halo Surface Signal indicates this is a likely risk because the plugin is designed to extend public-facing websites. Since WordPress sites are typically hosted on web servers meant to be reachable from the internet to serve content, these endpoints are often exposed. If your site uses this plugin and is accessible to the public, an attacker can reach the vulnerable code path from the internet.

What should I do first to manage this security risk?

Your first step is to perform an inventory of your WordPress environments to identify where this specific plugin is installed. Once you have a list of affected sites, prioritize those that are internet-facing. Evaluate the necessity of the plugin's features for each site and monitor for updates from the vendor that address the file upload validation flaw.

References

patchstack.com/database/wordpress/plugin/piotnet-addons-for-elemento…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.