CVE-2026-18351

🚨 [CRITICAL WORDPRESS RCE] — A NEW CVSS 9.8 FLAW CAN LET UNAUTHENTICATED ATTACKERS UPLOAD EXECUTABLE FILES.

CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms ≤1.6.0.

No login. No user interaction.

CyberSignal Priority: 🔴 VERY HIGH

1/8

The flaw is in the plugin's file-upload validation.

Wordfence says attacker-controlled input can manipulate MIME allowlist logic, bypass extension restrictions and get a crafted filename normalized into a PHP extension.

Result:

ARBITRARY FILE UPLOAD.

2/8

Potential attack chain:

Internet attacker ↓ No authentication ↓ Crafted upload request ↓ File-type validation bypass ↓ Executable PHP file uploaded ↓ Web server executes file ↓ REMOTE CODE EXECUTION

CVSS 3.1: 9.8 CRITICAL

3/8

The vulnerable function:

Validation issue:

The attacker-controlled type parameter is used in regex-based MIME checks, creating a path around the intended blacklist.

Affected: versions ≤1.6.0.

4/8

Why this matters:

WordPress upload bugs can collapse several security boundaries at once.

A feature meant to accept:

DOCUMENT / IMAGE

can become:

ATTACKER-CONTROLLED PHP ↓ SERVER EXECUTION.

And this flaw requires neither an account nor victim interaction.

5/8

🎯 What defenders should check:

→ Is the plugin installed? → Is the version ≤1.6.0? → Is the upload endpoint internet reachable? → Are unexpected PHP files present in writable/upload directories? → Did the web server spawn unusual child processes?

6/8

⚠️ Caveat:

The CVE record was published September 10.

That does NOT mean exploitation is occurring in the wild.

At this check:

CISA KEV: not listed Confirmed exploitation campaign: not established

Do not call it an exploited zero-day without evidence.

7/8

🛡️ Defender action:

Update/remove the plugin. Inspect writable directories for unexpected executables.

CyberSignal Insight:

UPLOAD VALIDATION IS CODE-EXECUTION SECURITY.

If an attacker controls what becomes executable, the upload feature becomes an RCE boundary.

8/8