CVE-2026-4885: Piotnet Addons for Elementor Pro - Unrestricted File Upload

Overview

The Piotnet Addons for Elementor Pro plugin for WordPress is affected by CVE-2026-4885, an arbitrary file upload issue caused by missing file type validation in the form function pafe_ajax_form_builder. According to the record, the plugin relies on an incomplete blocklist of extensions, so some dangerous file types are not blocked. The issue only applies when a file field is present in a form.

Impact

• The record describes arbitrary file upload by unauthenticated attackers.
• Uploaded files may make remote code execution on the web server possible, according to the record.
• The Wordfence CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.

Affected products and versions

• Product: Piotnet Addons for Elementor Pro, a WordPress plugin.
• The description states that all versions up to and including 7.1.70 are affected.
• The structured affected and fixes fields in the record are empty, so no fixed version is listed in the sources consulted.

Exploitation status

The record shows that the vulnerability is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00869 with a percentile of 0.57697. EPSS is a statistical estimate and does not confirm that exploitation is occurring.

Remediation and mitigation

• Check the vendor site at pafe.piotnet.com and the Wordfence advisory for an updated release newer than 7.1.70, and apply it once confirmed.
• If no update is available, consider removing file upload fields from public forms until the plugin is fixed.
• Validate uploads on the server side using an allowlist of expected file types rather than a blocklist, and do not rely on client-side checks.
• Restrict script execution inside upload directories at the web server level.
• Review user roles and keep WordPress core and other plugins up to date.

Detection guidance

• Review upload directories for recently created files with script-capable or unexpected extensions.
• Review web server and application logs for file submissions to form endpoints that come from unexpected sources or occur at unusual volumes.
• Use file integrity monitoring on the WordPress directory tree to flag new files that were not part of a known deployment.

Limitations of the available information

• The record does not list affected versions in structured form, and it provides no fixed version beyond the description's statement about 7.1.70.
• The record has no title, so the titles in this analysis were written from the description.
• Exposure depends on whether a site runs an affected version and whether its forms include file fields.
• The sources consulted do not document exploitation details or public exploit availability.
• The record's source status is Deferred.

Frequently asked questions

Is CVE-2026-4885 known to be exploited in the wild?

The record shows the vulnerability is not listed in CISA KEV, and the sources consulted do not confirm exploitation in the wild.

Which versions are affected?

The description states that all versions up to and including 7.1.70 are affected. The structured affected list in the record is empty, and no fixed version is listed.

Does exploitation require authentication or a specific form setup?

The record says unauthenticated attackers may upload files, but the issue only applies when a file field is added to a form.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.