PT-2026-41840 · WordPress · Piotnet Addons For Elementor

Wannes Verwimp · Published 2026-05-19 · Updated 2026-05-28 · CVE-2026-4885

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Piotnet Addons for Elementor Pro versions prior to 7.1.71

Description Missing file type validation in the pafe ajax form builder() function allows unauthenticated attackers to upload arbitrary files to the server. The plugin employs an incomplete extension blacklist that fails to block dangerous extensions such as .phar or .phtml, which may lead to remote code execution. This issue is only exploitable if a file field has been added to the form.

Recommendations Update to a version later than 7.1.70. As a temporary workaround, avoid adding file fields to forms until the update is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-4885

Affected Products

Piotnet Addons For Elementor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-4885 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ffff2ff3-769d-4eb2-acbe-d8ce6f042581?source=cve · Note
• https://twitter.com/CVEnew/status/2056670076162761166 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://twitter.com/OrizonCyber/status/2056653640165667136 · Twitter Post
• https://pafe.piotnet.com · Note