WordPress Drag and Drop File Upload for Elementor Forms Unrestricted File Upload Vulnerability

A vulnerability allowing unrestricted file upload has been identified in the WordPress plugin 'Drag and Drop File Upload for Elementor Forms', affecting versions through 1.5.3. This vulnerability could be exploited to upload web shells to the server, potentially leading to unauthorized access or control over the website.

Impact

Exploitation of this vulnerability allows for arbitrary file upload, which could be used to upload malicious files such as web shells that can be executed on the server.

Remediation

Users of the 'Drag and Drop File Upload for Elementor Forms' WordPress plugin should update to version 1.5.4 or later. Patchstack users can enable auto-updates for vulnerable plugins.