Introduction
Attackers have used file upload flaws in WordPress plugins to take full control of thousands of sites in 2025. CVE-2025-49387 in the Drag and Drop File Upload for Elementor Forms plugin is a critical example. It allows unauthenticated remote code execution through unrestricted file uploads. The plugin is widely used to add file upload features to Elementor forms, so its security matters to a broad segment of the WordPress ecosystem.
Technical information
CVE-2025-49387 is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw comes from insufficient server-side validation of uploaded files. The plugin accepts uploads without strict checks on file type, extension, or content, so an attacker can upload executable files, such as PHP web shells, to web-accessible directories.
An attack follows these steps:
- The attacker finds a WordPress site running a vulnerable version of the plugin (up to and including 1.5.3).
- They craft a malicious PHP file designed to provide remote command execution.
- They upload the file through the plugin's form. The plugin does not block or sanitize the dangerous file type.
- The plugin places the file in a directory that the web server can access and execute.
- The attacker opens the uploaded web shell and gains control over the server.
The flaw is technically similar to other recent file upload bugs in WordPress form plugins, where a lack of strict allowlisting and content inspection has led to widespread exploitation. No public code snippets are available for this specific vulnerability, but the exploitation pattern matches the one documented in related advisories.
Affected systems and versions
- Product: Drag and Drop File Upload for Elementor Forms (WordPress plugin by add-ons.org)
- Affected versions: All versions from initial release through 1.5.3
- Any WordPress site with this plugin active and at least one file upload form exposed is vulnerable
Vendor security history
The vendor, add-ons.org, develops plugins that extend Elementor. This plugin has had security issues before, including arbitrary file deletion vulnerabilities in version 1.4.3. The vendor has shipped security fixes in the past, notably in version 1.5.0, but critical issues keep recurring, which points to a need for stronger secure development practices and file validation.
