{
 "id": "WPSEC-2026-2733",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2733/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2733/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2733/index.md",
 "title": "Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via Form Submission File Field",
 "description": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Deletion via the file upload field's submitted value in all versions from 1.5.5 up to, and including, 1.6.2. This is due to the remove_files() cleanup routine, which runs when the field is set to not save files on the server, deleting the paths recorded from the submitted file names without checking that the files were uploaded through the field or that they stay inside the upload folder. This makes it possible for unauthenticated attackers submitting a form with this option enabled to delete any file in the plugin's upload folder, including files other users submitted and its protection files, and on Windows hosts files outside that folder.",
 "plugin": {
  "slug": "drag-and-drop-file-upload-for-elementor-forms",
  "name": "Drag and Drop File Upload for Elementor Forms",
  "full_name": "Drag and Drop File Upload for Elementor Forms",
  "wordpress_org": "https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/drag-and-drop-file-upload-for-elementor-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/drag-and-drop-file-upload-for-elementor-forms"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.5.5",
    "from_inclusive": true,
    "to": "1.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.5.5 before 1.6.3"
  ]
 },
 "introduced_in": "1.5.5",
 "fixed_in": "1.6.3",
 "remediation": "Update to 1.6.3 or later.",
 "fix_released": "2026-11-07T02:13:32+00:00",
 "published": "2026-11-08T02:40:41+00:00",
 "updated": "2026-11-07T11:09:28.099516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2733/",
  "https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.3/",
  "https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/drag-and-drop-file-upload-for-elementor-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}