Plattform
wordpress
Komponente
drag-and-drop-file-upload-for-elementor-forms
Behoben in
1.5.4
CVE-2025-49387 is an Arbitrary File Access vulnerability affecting the Drag and Drop File Upload for Elementor Forms plugin. This flaw allows attackers to upload files of any type, including malicious web shells, to the web server. Versions of the plugin from 0 through 1.5.3 are vulnerable. A patch has been released in version 1.5.4.
The primary impact of CVE-2025-49387 is the ability for an attacker to upload arbitrary files to the web server. This includes web shells, which provide a remote command execution interface. Successful exploitation could lead to complete server compromise, allowing attackers to steal sensitive data, modify website content, or use the server as a launchpad for further attacks. The lack of file type validation means attackers are not restricted in what they can upload, significantly increasing the potential for damage. Given the popularity of Elementor and the plugin's functionality, a widespread compromise is a significant concern. This vulnerability shares similarities with other file upload vulnerabilities where insufficient validation allows for the execution of malicious code.
CVE-2025-49387 was published on 2025-08-28. The vulnerability has a CVSS score of 10 (CRITICAL), indicating a high probability of exploitation. As of this writing, there are no publicly known active campaigns targeting this vulnerability, but the ease of exploitation and the plugin's popularity suggest it is a likely target. No entries on KEV or EPSS are currently available. Monitor security advisories and threat intelligence feeds for updates.
Exploit-Status
EPSS
0.13% (32% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2025-49387 is to immediately upgrade the Drag and Drop File Upload for Elementor Forms plugin to version 1.5.4 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include configuring a Web Application Firewall (WAF) to block uploads of suspicious file types (e.g., .php, .jsp, .asp) or restricting the upload directory permissions to prevent execution. Additionally, review existing file upload functionality on your website to ensure proper validation and sanitization of uploaded files. After upgrading, confirm the vulnerability is resolved by attempting to upload a test file with a known dangerous extension (e.g., .php) and verifying that the upload is rejected.
Actualice el plugin Drag and Drop File Upload for Elementor Forms a la última versión disponible para solucionar la vulnerabilidad de subida de archivos arbitrarios. Verifique la página del plugin en wordpress.org para obtener la versión más reciente y las instrucciones de actualización. Considere implementar medidas de seguridad adicionales, como restricciones de tipos de archivo y validación de nombres de archivo, para mitigar el riesgo.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
It's a CRITICAL vulnerability in the Drag and Drop File Upload for Elementor Forms plugin allowing attackers to upload any file, including web shells, potentially taking over your server.
If you are using Drag and Drop File Upload for Elementor Forms version 0 through 1.5.3, you are vulnerable and need to upgrade immediately.
Upgrade the plugin to version 1.5.4 or later. If immediate upgrade isn't possible, use a WAF to block suspicious file uploads as a temporary measure.
While no active campaigns are currently known, the vulnerability's severity and ease of exploitation make it a likely target. Monitor security feeds.
Refer to the official vendor advisory (if available) and the NVD entry for CVE-2025-49387 for detailed information.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.