CVE-2026-4885: Piotnet Addons for Elementor Pro RCE via File Upload
The National Vulnerability Database has issued a critical advisory for CVE-2026-4885, impacting the Piotnet Addons for Elementor Pro plugin for WordPress. This vulnerability, present in all versions up to and including 7.1.70, allows unauthenticated attackers to upload arbitrary files due to inadequate file type validation in the pafe_ajax_form_builder function. The plugin’s blacklist for extensions is incomplete, failing to block dangerous types like .phar and .phtml.
This oversight enables attackers to bypass basic security controls and introduce malicious files onto the server. If a form with a file upload field is present, this flaw can be exploited to achieve remote code execution (RCE). The National Vulnerability Database assigns this a CVSS score of 9.8 (CRITICAL), underscoring the severe risk it poses to affected WordPress sites.
For defenders, this is a clear-cut case of a critical vulnerability that can lead directly to full system compromise. The attacker’s calculus is simple: find a site running a vulnerable version with a form that includes a file upload field, then exploit the weak validation to drop a web shell or other malicious script. This bypasses authentication, making it a low-friction, high-impact attack vector.
What This Means For You
- If your organization uses the Piotnet Addons for Elementor Pro plugin, you need to immediately verify your version. Patch to the latest available version beyond 7.1.70. If patching isn't possible, audit all forms for file upload fields and consider disabling the plugin until a fix is deployed, especially on public-facing sites.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-4885: Piotnet Addons for Elementor Pro Arbitrary File Upload (.phar, .phtml)
title: CVE-2026-4885: Piotnet Addons for Elementor Pro Arbitrary File Upload (.phar, .phtml)
id: scw-2026-05-19-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-4885 by uploading files with dangerous extensions (.phar, .phtml) via the 'pafe_ajax_form_builder' AJAX endpoint in Piotnet Addons for Elementor Pro. This is a critical vulnerability allowing unauthenticated arbitrary file upload, leading to potential RCE.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-4885/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method:
- 'POST'
uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=pafe_ajax_form_builder'
sc-status:
- 200
selection_indicators:
uri|contains:
- '.phar'
- '.phtml'
condition: selection AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-4885 | RCE | Piotnet Addons for Elementor Pro plugin for WordPress |
| CVE-2026-4885 | Arbitrary File Upload | Piotnet Addons for Elementor Pro plugin for WordPress versions <= 7.1.70 |
| CVE-2026-4885 | Arbitrary File Upload | Vulnerable function: 'pafe_ajax_form_builder' |
| CVE-2026-4885 | Arbitrary File Upload | Incomplete extension blacklist allowing .phar or .phtml uploads |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 19, 2026 at 11:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-8922 — Keycloak Vulnerability
CVE-2026-8922 — A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails...
CVE-2026-47317 — Samsung Open Source Escargot Vulnerability
CVE-2026-47317 — Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
CVE-2026-47316 — Samsung Open Source Escargot Vulnerability
CVE-2026-47316 — Improper Check or Handling of Exceptional Conditions vulnerability in Samsung Open Source Escargot allows Input Data Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.