CVE-2025-49387 CRITICAL

CVE-2025-49387: WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability

Vendor Add-Ons.org
Product Drag and Drop File Upload for Elementor Forms
Weakness CWE-434 · Unrestricted file upload
Published August 28, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.5.3.

Explanation of Vulnerability in Simple Terms

02Summary

An attacker can upload arbitrary files to a site running Drag and Drop File Upload for Elementor Forms without authentication or user interaction. The vulnerability allows uploading malicious files that can be executed on the server, compromising the entire site. All versions up to 1.5.3 are affected. Update immediately to a version newer than 1.5.3.

What an attacker can do

03Attacker Capabilities

Upload and execute arbitrary files on the server without authentication.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can run code, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 28, 2025 CVE published
April 28, 2026 Record updated