What the vulnerability does
01Description
The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
Explanation of Vulnerability in Simple Terms
02Summary
Piotnet Addons For Elementor Pro versions 7.1.70 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can exploit this over the network without any user interaction to upload malicious files, potentially leading to complete site compromise including data theft, modification, and service disruption.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the site without authentication, potentially executing malicious code.
Potential impact on your site
04Site Impact
Attackers can upload and execute malicious files, leading to full site compromise, data theft, and defacement.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 19, 2026
CVE published
May 19, 2026
Record updated
