CVE-2026-28192: Piotnet Addons File Upload Vulnerability

CVE-2026-28192 Overview

CVE-2026-28192 is an unauthenticated arbitrary file upload vulnerability in the Piotnet Addons For Elementor Pro WordPress plugin, affecting versions up to and including 7.1.67. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type and allows attackers to upload files without authentication. Successful exploitation can lead to remote code execution on the underlying WordPress host. The issue was disclosed through Patchstack and requires only network access with user interaction to trigger.

Critical Impact
Unauthenticated attackers can upload arbitrary files to vulnerable WordPress sites, enabling web shell deployment and full site compromise.

Affected Products

Piotnet Addons For Elementor Pro plugin versions <= 7.1.67
WordPress installations running the vulnerable plugin
Elementor Pro sites using Piotnet form or upload widgets

Discovery Timeline

2026-08-18 - CVE-2026-28192 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-28192

Vulnerability Analysis

The Piotnet Addons For Elementor Pro plugin exposes a file upload handler that does not properly validate the type, extension, or content of files submitted by clients. Because the endpoint is reachable without authentication, any visitor can invoke it. An attacker can upload executable PHP files into a location served by the web server. Once uploaded, the file can be requested directly to execute arbitrary code in the context of the WordPress process.

The scope change indicated in the vector reflects that a compromised plugin endpoint can impact the entire WordPress instance and hosted content. Impact extends to confidentiality, integrity, and availability of the site.

Root Cause

The root cause is missing or insufficient server-side validation of uploaded files [CWE-434]. The handler trusts client-supplied file metadata and does not enforce an allowlist of safe MIME types or extensions. It also fails to place uploads outside the web-executable path or strip executable extensions before writing to disk.

Attack Vector

An attacker crafts a multipart HTTP request targeting the plugin's upload endpoint and submits a PHP payload disguised as a benign file type. User interaction is required, typically in the form of a victim visiting an attacker-controlled page that triggers the upload flow. After the file is written to a predictable path in wp-content/uploads/, the attacker requests the file directly to execute their payload.

No verified proof-of-concept code has been published. Technical detail is available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-28192

Indicators of Compromise

Newly created PHP, .phtml, or .phar files under wp-content/uploads/ or plugin-specific upload directories
HTTP POST requests to Piotnet plugin upload endpoints from unauthenticated sessions
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts
WordPress admin users or options rows created outside of change windows

Detection Strategies

Monitor web server access logs for POST requests to Piotnet plugin AJAX or REST endpoints followed by GET requests to files in uploads/.
Alert on any file with an executable server-side extension written under wp-content/uploads/.
Correlate file creation events on the WordPress host with subsequent process execution by the web server user.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin directories.
Ingest WordPress, web server, and PHP error logs into a centralized log platform for correlation.
Track outbound connections from web workers to detect post-exploitation command-and-control activity.

How to Mitigate CVE-2026-28192

Immediate Actions Required

Update Piotnet Addons For Elementor Pro to a version later than 7.1.67 as soon as the vendor releases a fixed build.
If no patched version is available, deactivate and remove the plugin from all WordPress installations.
Audit wp-content/uploads/ for unexpected executable files and remove any web shells identified.
Rotate WordPress administrator credentials and API keys if compromise is suspected.

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed-version guidance from the vendor and Patchstack. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files directly.

Workarounds

Deploy a web application firewall rule to block requests to the vulnerable Piotnet upload endpoints until patched.
Configure the web server to deny execution of PHP within wp-content/uploads/ using directory-level handlers.
Restrict access to /wp-admin/admin-ajax.php actions associated with the plugin via IP allowlisting where feasible.

bash

# Apache: prevent PHP execution inside the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}