CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5.
Explanation of Vulnerability in Simple Terms
Reformer for Elementor versions 1.0.5 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—including PHP scripts—to gain control of the site. No user interaction or authentication is required. This vulnerability affects all installations of the plugin.
What an attacker can do
Upload arbitrary files, including PHP scripts, to run code on the site and take full control.
Potential impact on your site
Complete site compromise: attackers can execute code, steal data, modify content, and deface the site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
