PT-2025-22748 · Elementor · Drag/Drop File Upload For Elementor Forms

0Xd4Rk5Id3 · Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-47492

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop File Upload for Elementor Forms versions 1.4.3 and earlier

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability affects the Drag and Drop File Upload for Elementor Forms, allowing unauthorized access to files outside the intended directory.

Recommendations For versions 1.4.3 and earlier, update to a version later than 1.4.3 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-47492

Affected Products

Drag/Drop File Upload For Elementor Forms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-47492 · Security Note
• https://twitter.com/CVEnew/status/1925901312786403666 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-1-4-3-arbitrary-file-deletion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-1-4-3-arbitrary-file-deletion-vulnerability?_s_id=cve · Note