CVE-2025-47492: Elementor Forms File Upload Path Traversal

CVE-2025-47492 Overview

CVE-2025-47492 is a path traversal vulnerability [CWE-22] in the add-ons.org Drag and Drop File Upload for Elementor Forms WordPress plugin. The flaw affects all versions up to and including 1.4.3 and enables unauthenticated attackers to delete arbitrary files on the server. Successful exploitation can disrupt site availability, including triggering WordPress installation reset states when critical files such as wp-config.php are removed.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files on affected WordPress sites, leading to denial of service and potential site takeover scenarios.

Affected Products

add-ons.org Drag and Drop File Upload for Elementor Forms plugin
All versions from n/a through 1.4.3
WordPress sites running the vulnerable plugin alongside Elementor Forms

Discovery Timeline

2025-05-23 - CVE-2025-47492 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47492

Vulnerability Analysis

The vulnerability resides in file-handling routines of the Drag and Drop File Upload for Elementor Forms plugin. The plugin fails to properly sanitize user-supplied path components before passing them to file system operations. Attackers can submit specially crafted input containing directory traversal sequences such as ../ to escape the intended upload directory and reference arbitrary locations on the server file system.

According to the Patchstack advisory, the vulnerability enables arbitrary file deletion. An unauthenticated attacker can craft a request that traverses outside the plugin's working directory and removes files belonging to WordPress core, themes, other plugins, or the underlying host. Deleting wp-config.php is a common impact path because WordPress treats the missing configuration file as an unconfigured installation, allowing an attacker to reinitialize the site with attacker-controlled database credentials.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The plugin accepts a filename or path parameter from the request and concatenates it into a file system call without canonicalizing the path or validating that the resolved location remains within an allowed base directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the plugin's file-handling endpoint containing path traversal sequences in the targeted filename parameter. The EPSS score is 1.294% at the 79.779 percentile, reflecting moderate observed exploitation interest for this class of WordPress plugin flaw.

No verified public proof-of-concept code is referenced in the advisory. See the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-47492

Indicators of Compromise

HTTP requests to the plugin's AJAX or upload endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected deletion or absence of wp-config.php, .htaccess, or core WordPress files.
WordPress unexpectedly presenting the initial setup or installation wizard to visitors.
Web server error logs showing file-not-found errors for previously valid files.

Detection Strategies

Inspect web access logs for POST requests to plugin endpoints containing traversal patterns in filename parameters.
Monitor file integrity for WordPress core, plugin, and configuration files using a host-based integrity tool.
Alert on sudden changes to site state, including unexpected redirects to the WordPress installation page.

Monitoring Recommendations

Enable WAF rules that block path traversal payloads in request bodies and query strings.
Forward WordPress and web server logs to a central SIEM and correlate file deletion events with inbound HTTP traffic.
Track plugin inventory across managed WordPress sites to identify exposure to vulnerable versions.

How to Mitigate CVE-2025-47492

Immediate Actions Required

Update the Drag and Drop File Upload for Elementor Forms plugin to a version higher than 1.4.3 as soon as a patched release is available from the vendor.
If no patched version is available, deactivate and remove the plugin from affected WordPress installations.
Audit the file system for missing or modified WordPress core and configuration files.

Patch Information

The vulnerability affects all versions through 1.4.3. Administrators should consult the Patchstack advisory for the latest fixed version information and apply the vendor patch through the WordPress plugin manager.

Workarounds

Deploy a WAF rule blocking requests containing ../ or encoded traversal sequences targeting plugin endpoints.
Restrict file system permissions so the web server user cannot delete WordPress core files such as wp-config.php.
Place the affected site behind authentication or IP allowlisting until the plugin is updated or removed.

bash

# Example WAF/ModSecurity rule blocking traversal in plugin requests
SecRule REQUEST_URI "@contains drag-and-drop-file-upload-for-elementor-forms" \
  "chain,id:1004749,phase:2,deny,status:403,log,msg:'CVE-2025-47492 path traversal attempt'"
  SecRule ARGS|REQUEST_BODY "@rx (\.\./|\.\.\\\\|%2e%2e(%2f|%5c))" "t:lowercase,t:urlDecodeUni"