CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-4885 — The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbit...

·Source: NIST NVD

Updated:

Executive Summary

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uplo

Analysis

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt, php5, php7, and exe extensions, while allowing dangerous extensions such as .phar or .phtml to be uploaded. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit can only be exploited if a file field is added to the form. CVSS Score: 9.8. Published: 2026-05-19T08:16:16.223.

Indicators of Compromise (1)

CVE (1)
CVE-2026-4885
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on May 19, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-7284 — The Easy Elements for Elementor – Addons & Website Templates plugin for WordPres...

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registr

CVE-2026-7284
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-6555 — The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File U...

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload

CVE-2026-6555
NIST NVD
MEDIUMVulnerability

Deutsche Bank applies AI to third party vendor risks

Deutsche Bank is using artifical intelligence to speed up the tedious, time-consuming, process of reviewing third party vendor risks.

Finextra