WordPress plugin
Drag and Drop File Upload for Elementor Forms security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High1
- Medium1
- Low0
All Drag and Drop File Upload for Elementor Forms vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.2 | Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter ≤1.6.2Update to 1.6.3 | CVE-2026-124218 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via 'type' Parameter ≤1.6.0Update to 1.6.1 | CVE-2026-18351 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤1.5.3Update to 1.5.4 | CVE-2025-49387 | |
| Medium5.3 | Unauthenticated Arbitrary File Deletion ≤1.4.3Update to 1.5.0 | CVE-2025-47492 |
- High8.2Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter
≤1.6.2Update to 1.6.3
- Critical9.8Unauthenticated Arbitrary File Upload via 'type' Parameter
≤1.6.0Update to 1.6.1
- Critical9.8Unauthenticated Arbitrary File Upload
≤1.5.3Update to 1.5.4
- Medium5.3Unauthenticated Arbitrary File Deletion
≤1.4.3Update to 1.5.0
Drag and Drop File Upload for Elementor Forms: common questions
Does Drag and Drop File Upload for Elementor Forms have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in Drag and Drop File Upload for Elementor Forms: 2 critical, 1 high, 1 medium. None are known to affect version null.
How do I check which version of Drag and Drop File Upload for Elementor Forms I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Drag and Drop File Upload for Elementor Forms vulnerability?
CVE-2026-124218, published Nov 12, 2026: Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter. Severity: High (CVSS 8.2).
Is any Drag and Drop File Upload for Elementor Forms vulnerability listed in CISA KEV?
No. None of the known Drag and Drop File Upload for Elementor Forms vulnerabilities is currently listed in the CISA KEV catalog.