The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the…
The Piotnet Addons for Elementor Pro plugin for WordPress has a vulnerability that allows arbitrary file upload due to missing file type validation. This can lead to remote code execution and severe security issues. Developers should ensure proper file type validation and upload handling to prevent such issues.
The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form.
WordPress sites using the affected Piotnet Addons for Elementor Pro plugin are at risk of remote code execution, which can lead to critical security issues and data breaches.
Immediate Action Required
This vulnerability is critical and can be exploited with high impact.
What should I do?
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0
Affected Products
2
References
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Impact