CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_type_valid() function, which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass via a crafted extension that sanitize_file_name() later normalizes to a PHP extension. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

• CWE-434

• https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/drag-and-drop-file-upload-for-elementor-forms.php
• https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php
• https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.0/fields/file_upload.php#L833
• https://plugins.trac.wordpress.org/changeset/3628051/drag-and-drop-file-upload-for-elementor-forms
• https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12?source=cve

Published

Sep 10, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18345The WP User Manager plugin for WordPress is vulnerable to un…4.3
• CVE-2026-18346The TikTok plugin for WordPress is vulnerable to authorizati…5.3
• CVE-2026-18347The Kirki – Freeform Page Builder, Website Builder & Customi…4.3
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-18349Improper protection against voltage and clock glitches vulne…7.3
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18352The User Access Manager plugin for WordPress is vulnerable t…7.5
• CVE-2026-18353PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT a…8.8
• CVE-2026-18355A heap buffer overflow flaw was found in the SASL I/O layer …7.5
• CVE-2026-18356The Limit Login Attempts Reloaded WordPress plugin before 3.…3.7
• CVE-2026-18357The WPC Order Tip for WooCommerce WordPress plugin before 3.…7.5
• CVE-2026-18358A flaw was found in gnome-remote-desktop as shipped in Red H…7.5