{
 "id": "WPSEC-2026-2734",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2734/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2734/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2734/index.md",
 "title": "Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Path Traversal to File Overwrite and Deletion via Form Submission File Field",
 "description": "The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Path Traversal via the file upload field's submitted value in all versions from 1.6.0 up to, and including, 1.6.2. This is due to the process_field() function building temporary and destination paths from the submitted file name with no sanitization (it is only split on '/') and then moving the file from the temporary folder to the uploads folder with overwriting enabled. This makes it possible for unauthenticated attackers submitting the form to overwrite files other visitors already submitted, to delete the contents of the plugin's upload folders by submitting names such as '.' or '..', and on Windows hosts to delete files outside the upload folder using backslash separators.",
 "plugin": {
  "slug": "drag-and-drop-file-upload-for-elementor-forms",
  "name": "Drag and Drop File Upload for Elementor Forms",
  "full_name": "Drag and Drop File Upload for Elementor Forms",
  "wordpress_org": "https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/drag-and-drop-file-upload-for-elementor-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/drag-and-drop-file-upload-for-elementor-forms"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.6.0",
    "from_inclusive": true,
    "to": "1.6.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.6.0 before 1.6.3"
  ]
 },
 "introduced_in": "1.6.0",
 "fixed_in": "1.6.3",
 "remediation": "Update to 1.6.3 or later.",
 "fix_released": "2026-11-07T02:13:32+00:00",
 "published": "2026-11-08T02:40:41+00:00",
 "updated": "2026-11-07T11:09:28.099516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2734/",
  "https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.3/",
  "https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/drag-and-drop-file-upload-for-elementor-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}