# Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Path Traversal to File Overwrite and Deletion via Form Submission File Field

- **ID:** WPSEC-2026-2734
- **Plugin:** Drag and Drop File Upload for Elementor Forms (`drag-and-drop-file-upload-for-elementor-forms`), https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/
- **Affected versions:** from 1.6.0 before 1.6.3
- **Fixed in:** 1.6.3 (Update to 1.6.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/drag-and-drop-file-upload-for-elementor-forms
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2734/

## Description

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Path Traversal via the file upload field's submitted value in all versions from 1.6.0 up to, and including, 1.6.2. This is due to the process_field() function building temporary and destination paths from the submitted file name with no sanitization (it is only split on '/') and then moving the file from the temporary folder to the uploads folder with overwriting enabled. This makes it possible for unauthenticated attackers submitting the form to overwrite files other visitors already submitted, to delete the contents of the plugin's upload folders by submitting names such as '.' or '..', and on Windows hosts to delete files outside the upload folder using backslash separators.

## References

- https://wpsec.com/vuln/WPSEC-2026-2734/
- https://plugins.svn.wordpress.org/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.3/
- https://wordpress.org/plugins/drag-and-drop-file-upload-for-elementor-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2734/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.