PT-2025-35035 · WordPress · Drag/Drop File Upload For Elementor Forms

Phat Rio - Bluerock · Published 2025-08-28 · Updated 2025-08-28 · CVE-2025-49387

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop File Upload for Elementor Forms versions n/a through 1.5.3

Description The Drag and Drop File Upload for Elementor Forms WordPress plugin is susceptible to an unrestricted file upload issue. This allows for the upload of a Web Shell to a web server. Attackers can exploit this to upload malicious files.

Recommendations Drag and Drop File Upload for Elementor Forms versions prior to 1.5.3 should be updated.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-49387

Affected Products

Drag/Drop File Upload For Elementor Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-49387 · Security Note
• https://twitter.com/ZeroPathLabs/status/1961092454179807301 · Twitter Post
• https://twitter.com/CVEnew/status/1961052817688305853 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-plugin-1-5-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1961054234910011736 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-plugin-1-5-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note