CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
Explanation of Vulnerability in Simple Terms
The Drag and Drop File Upload for Elementor Forms plugin contains a path traversal vulnerability that allows an attacker to manipulate file upload paths. By crafting malicious requests, an attacker can write files outside the intended upload directory, potentially overwriting critical site files or injecting malicious code. No authentication is required to exploit this flaw.
What an attacker can do
Write files to arbitrary locations on the server, potentially overwriting site files or injecting malicious code.
Potential impact on your site
Attackers can compromise your site by uploading malicious files to critical directories, leading to data loss or site takeover.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
