Quick Look: CVE-2026-4885 — Unauthenticated Arbitrary File Upload in Piotnet Addons for Elementor Pro

Introduction

An incomplete file extension blacklist in a popular WordPress form builder plugin allows unauthenticated remote code execution on potentially thousands of WordPress sites. CVE-2026-4885 affects Piotnet Addons for Elementor Pro, a plugin that adds advanced form functionality to the widely used Elementor page builder. It carries a CVSS score of 9.8, and no patch is currently available.

Piotnetdotcom develops Piotnet Addons for Elementor, which adds widgets, form builders, and interactive elements to WordPress sites that use Elementor. The free version alone has over 30,000 active installations on the WordPress plugin repository, and the Pro version adds premium features, including advanced form file uploads. The plugin sits in the critical path for user input on these sites, so a flaw in it directly affects site integrity.

Technical Information

The vulnerability is in the pafe_ajax_form_builder function, which handles file uploads submitted through forms built with Piotnet Addons for Elementor Pro. The function validates file types against an extension blacklist rather than an allowlist. The blacklist blocks php, phpt, php5, php7, and exe, but it misses other extensions that Apache and other web servers can be configured to interpret as executable PHP code.

The table below shows the gap in the blacklist:

Many default or common Apache configurations pass files with .phar (PHP Archive) and .phtml (PHP HTML) extensions to the PHP interpreter. An attacker can therefore write a PHP webshell or other malicious payload, save it with one of these extensions, and upload it through the form. When anyone requests the uploaded file's URL, the server executes its contents as PHP.

Attack Flow

Exploitation is straightforward and requires no authentication:

1. The attacker identifies a WordPress site running Piotnet Addons for Elementor Pro version 7.1.70 or earlier.
2. The attacker locates a form on the site that includes a file upload field generated by the plugin.
3. The attacker crafts a malicious PHP payload and names the file with a .phar or .phtml extension.
4. The attacker submits the form with the malicious file attached. Because the blacklist does not include these extensions, the upload succeeds without any authentication check.
5. The attacker navigates to the uploaded file's URL on the server.
6. The web server processes the file as PHP and executes the attacker's code with the privileges of the web server process.

The only precondition is a file upload field on at least one form built with the affected plugin. The attacker needs no credentials, no special headers, and no complex chaining.

The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). This exact function has been the source of a critical file upload flaw before. In 2021, researchers at Imunify360 disclosed a similar unauthenticated file upload and remote code execution vulnerability in the same pafe_ajax_form_builder function, which suggests the vendor never fully addressed the underlying validation logic.

Affected Systems and Versions

All versions of Piotnet Addons for Elementor Pro from the initial release through version 7.1.70 (inclusive) are affected. The vulnerability is exploitable on any WordPress installation where:

• Piotnet Addons for Elementor Pro version 0 through 7.1.70 is installed and active
• At least one form created with the plugin contains a file upload field
• The web server is configured to execute .phar or .phtml files as PHP (which is common in default Apache configurations)

No patch is available as of May 19, 2026. The most recent release, version 7.1.70 (March 11, 2026), fixed Server Side Request Forgery and Cross Site Scripting issues but does not fix this file upload vulnerability.

Vendor Security History

Piotnetdotcom has a documented pattern of severe input validation and authorization vulnerabilities across its product line:

The 2021 vulnerability affected the same pafe_ajax_form_builder function. A nearly identical flaw turning up in the same code path five years later raises questions about how the vendor handles security remediation and code review.

References

• CVE Record: CVE-2026-4885
• Wordfence Threat Intelligence: Piotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload
• Piotnet Addons for Elementor Pro Official Site
• PAFE Change Log
• Piotnet Addons For Elementor on WordPress.org
• Imunify360: High Severity Vulnerabilities in Piotnet Forms and Piotnet Addons for Elementor Pro
• Access Violation Vulnerability in Piotnet Forms 1.0.25
• CISA Vulnerability Summary for the Week of March 31, 2025
• Entryzero Weekly Briefing: Top Hacker Relevant Vulnerabilities