Drag and Drop File Upload for Elementor Forms
Drag and Drop File Upload for Elementor Forms has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 8.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 0 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (67%). Other recurring categories include Path Traversal.
Every one of the 3 issues recorded for Drag and Drop File Upload for Elementor Forms has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Drag and Drop File Upload for Elementor Forms is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-18351Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
Read the full analysisVulnerability Records
Drag and Drop File Upload for Elementor Forms
Author
add-ons.org
elementorDEMO: https://demo.add-ons.org/demo-drag-and-drop-fields/ Download Pro Version: https://add-ons.org/plugin/drag-and-drop-file-upload-for-elementor-forms-pro/ Document: https://add-ons.org/document-elementor-drag-and-drop-multiple-file-upload/ Drag and Drop File Upload for Elementor Forms is a powerful, lightweight, and user-friendly add-on designed to enhance the default Elementor form capabilities. If you are looking for an intuitive way to collect files, documents, or images from your users, this plugin provides a robust multiple file upload area completely integrated with the native Elementor Forms builder. Enhance your user experience by allowing visitors to effortlessly drag and drop files or use the traditional browse button. With full control over file size limits, allowed file types, and upload quantity, you can securely and effectively collect the exact assets you need without cluttering your inbox. Whether you are collecting resumes, user-generated content, portfolio submissions, or support documents, this plugin offers premium functionality including direct integration with Dropbox and the WordPress Media Library. Features Seamless Drag & Drop Interface: Provide a modern, interactive upload area that users love. Multiple Files Upload: Allow users to upload one or several files at once. Limit Upload Quantity: Prevent spam by restricting the maximum number of files per submission. Secure File Type Validation: Specify exact file extensions (e.g., pdf, docx, jpg, zip) to restrict unwanted uploads. File Size Validation: Set maximum file size limits to save server storage and improve performance. Image Thumbnails Preview: Instantly display attractive thumbnail previews for uploaded images. Email Attachments: Automatically attach uploaded files directly to your Elementor Form notification emails, or send them as clean HTML links. Save to WordPress Media Library: Store submitted files directly within your native WP Media dashboard. Save to Dropbox: Offload file storage by automatically syncing user uploads directly to your Dropbox account. Fully Customizable UI: Tweak button styles, padding, colors, and borders right from the Elementor editor. Translation Ready: Easily translate “Drag & Drop Files Here” or “Browse Files” buttons to any language. Mobile Responsive: Flawlessly works on all mobile devices and touch screens. Pro Versions Save files to Dropbox Show Thumbnail for images Flash Message Support
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C