CVE-2026-18351Disclosure

🚨 WordPress'te kritik RCE açığı: CVE-2026-18351 Drag and Drop File Upload for Elementor Forms eklentisinde CVSS 9.8 Critical seviyesinde güvenlik açığı tespit edildi. 🔴 Kimlik doğrulama gerektirmiyor (Unauthenticated) 🔴 Arbitrary File Upload 🔴 Uygun koşullarda Remote Code Execution (RCE) 🔴 Etkilenen sürümler: 1.6.0 ve öncesi 🛠️ Güvenli sürüm: 1.6.1 Saldırgan, dosya türü doğrulamasını aşarak kötü amaçlı dosya yükleyebilir ve sunucuda kod çalıştırmaya kadar ilerleyebilir. WordPress üzerinde bu eklentiyi kullananların sürümlerini kontrol ederek 1.6.1+ sürümüne güncellemesi gerekiyor. https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/

🚨 [CRITICAL WORDPRESS RCE] — A NEW CVSS 9.8 FLAW CAN LET UNAUTHENTICATED ATTACKERS UPLOAD EXECUTABLE FILES. CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms ≤1.6.0. No login. No user interaction. CyberSignal Priority: 🔴 VERY HIGH 1/8 The flaw is in the plugin's file-upload validation. Wordfence says attacker-controlled input can manipulate MIME allowlist logic, bypass extension restrictions and get a crafted filename normalized into a PHP extension. Result: ARBITRARY FILE UPLOAD. 2/8 Potential attack chain: Internet attacker ↓ No authentication ↓ Crafted upload request ↓ File-type validation bypass ↓ Executable PHP file uploaded ↓ Web server executes file ↓ REMOTE CODE EXECUTION CVSS 3.1: 9.8 CRITICAL 3/8 The vulnerable function: `elementor_file_upload` Validation issue: `is_file_type_valid()` The attacker-controlled `type` parameter is used in regex-based MIME checks, creating a path around the intended blacklist. Affected: versions ≤1.6.0. 4/8 Why this matters: WordPress upload bugs can collapse several security boundaries at once. A feature meant to accept: DOCUMENT / IMAGE can become: ATTACKER-CONTROLLED PHP ↓ SERVER EXECUTION. And this flaw requires neither an account nor victim interaction. 5/8 🎯 What defenders should check: → Is the plugin installed? → Is the version ≤1.6.0? → Is the upload endpoint internet reachable? → Are unexpected PHP files present in writable/upload directories? → Did the web server spawn unusual child processes? 6/8 ⚠️ Caveat: The CVE record was published September 10. That does NOT mean exploitation is occurring in the wild. At this check: CISA KEV: not listed Confirmed exploitation campaign: not established Do not call it an exploited zero-day without evidence. 7/8 🛡️ Defender action: Update/remove the plugin. Inspect writable directories for unexpected executables. CyberSignal Insight: UPLOAD VALIDATION IS CODE-EXECUTION SECURITY. If an attacker controls what becomes executable, the upload feature becomes an RCE boundary. 8/8

A WordPress upload plugin validated the file type, then ran sanitize_file_name(), which turned the crafted extension into .php. The check passed on a string that no longer existed by the time the file was written. CVE-2026-18351, 9.8. Validate after normalization, not before.

⚠️ Vulnerabilidades en complementos de WordPress ❗ CVE-2026-18351 ❗ CVE-2026-14873 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-complementos-de-wordpress-2/ https://t.co/zXKcyNwvoT

Si tu formulario de Elementor deja subir archivos con el plugin Drag and Drop (≤1.6.0), actualiza. No es Elementor Pro. Sin login podían tomar el sitio. Si no, desactiva el upload. https://www.wavys-technologies.com/es/blog/drag-drop-file-upload-elementor-forms-cve-2026-18351

CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elem… https://www.cve.org/CVERecord?id=CVE-2026-18351

🆕👉 Drag and Drop File Upload for Elementor Forms https://wpdeeply.com/drag-and-drop-file-upload-elementor-forms-1-6-0-unauthenticated-arbitrary-file-upload/ #loreleiweb CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms, a WordPress plugin that adds drag-and-drop upload fields to Elementor forms. Patchstack published the issue on Septembe… https://t.co/80dTfyNrNQ