CVE-2023-48777 CRITICAL

CVE-2023-48777: WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

Vendor Elementor.com
Product Elementor Website Builder
Weakness CWE-434 · Unrestricted file upload
Published March 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor.Com Elementor Website Builder.This issue affects Elementor Website Builder: from 3.3.0 through 3.18.1.

Explanation of Vulnerability in Simple Terms

02Summary

Elementor Website Builder versions 3.3.0 through 3.18.1 allow authenticated users with low privileges to upload files without proper validation. An attacker can upload malicious files to compromise the site's integrity and confidentiality. The vulnerability affects the entire site due to scope change, enabling data theft, site defacement, or malware injection.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the site and execute code or steal sensitive data.

Potential impact on your site

04Site Impact

Attackers with basic site access can upload and execute malicious code, leading to full site compromise.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account (e.g., subscriber or contributor role) on the site.

Key dates

06Disclosure timeline

March 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2020-37227 WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 CVE-2026-9227 GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter CVE-2026-40750 WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability