CVE-2026-4885: Piotnet Addons for Elementor RCE Flaw

CVE-2026-4885 Overview

CVE-2026-4885 is an arbitrary file upload vulnerability in the Piotnet Addons for Elementor Pro plugin for WordPress. The flaw affects all versions up to and including 7.1.70. The pafe_ajax_form_builder function relies on an incomplete extension blacklist that blocks only php, phpt, php5, php7, and exe extensions. Attackers can upload files with bypass extensions such as .phar and .phtml, both of which many WordPress hosting stacks execute as PHP. Unauthenticated remote attackers can exploit the issue when a form on the target site includes a file upload field. Successful exploitation enables remote code execution under the web server account.

Critical Impact

Unauthenticated attackers can upload executable PHP-handler files and achieve remote code execution on affected WordPress sites.

Affected Products

• Piotnet Addons for Elementor Pro plugin for WordPress
• All plugin versions up to and including 7.1.70
• WordPress sites with a Piotnet form configured to accept file uploads

Discovery Timeline

• 2026-05-19 - CVE-2026-4885 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-4885

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The pafe_ajax_form_builder AJAX handler accepts uploads from unauthenticated visitors when a form contains a file field. The handler validates uploads using a denylist of dangerous extensions rather than an allowlist of approved types. The denylist enumerates php, phpt, php5, php7, and exe but omits other extensions that Apache and many shared hosting providers map to the PHP handler. Attackers supply files with extensions such as .phar or .phtml to bypass the filter while still triggering PHP execution when the resulting URL is requested.

Root Cause

The root cause is reliance on an incomplete extension blacklist for file type validation in the AJAX form builder upload path. The handler performs no MIME type verification, no content inspection, and no enforcement of an allowlist. Any extension absent from the hardcoded denylist is accepted and written to disk inside the WordPress uploads directory.

Attack Vector

An unauthenticated attacker locates a public page that renders a Piotnet form containing a file field. The attacker submits a crafted multipart request to the pafe_ajax_form_builder AJAX endpoint with a payload file named with a .phar or .phtml extension. The server stores the file in a web-accessible path. Requesting the uploaded file URL executes the embedded PHP code in the context of the web server user, granting remote code execution and a foothold for lateral movement, data theft, or site defacement.

Detection Methods for CVE-2026-4885

Indicators of Compromise

• Files with .phar, .phtml, .pht, .php3, .php4, or other PHP-handler extensions present in the WordPress wp-content/uploads/ directory.
• POST requests to admin-ajax.php with the action=pafe_ajax_form_builder parameter from unauthenticated sources.
• New PHP processes spawning shells, curl, wget, or outbound connections originating from the web server user.
• Modifications to WordPress core files, theme files, or new administrator accounts created shortly after suspicious upload events.

Detection Strategies

• Audit wp-content/uploads/ for files with PHP-executable extensions and compare against expected media types.
• Inspect web server access logs for pafe_ajax_form_builder AJAX calls followed by GET requests to newly written files.
• Monitor for web server processes invoking interpreters or command-line utilities outside normal PHP-FPM activity.

Monitoring Recommendations

• Enable file integrity monitoring across the WordPress installation and uploads directory.
• Forward web server, PHP-FPM, and WordPress logs to a centralized SIEM for correlation against AJAX action patterns.
• Alert on creation of files with double extensions or non-media MIME content inside upload directories.

How to Mitigate CVE-2026-4885

Immediate Actions Required

• Update the Piotnet Addons for Elementor Pro plugin to a version later than 7.1.70 once the vendor releases a patched build.
• Disable or remove the plugin if a patched version is not yet available and the site uses Piotnet forms with file fields.
• Inspect the server for previously uploaded malicious files and rotate WordPress administrator credentials and API keys if compromise is suspected.

Patch Information

Refer to the vendor for patched releases and advisories at the Piotnet Security Resource and consult the Wordfence Vulnerability Report for tracking remediation status.

Workarounds

• Remove file upload fields from all Piotnet forms until a patched plugin version is installed.
• Configure the web server to deny execution of .phar, .phtml, .pht, and other PHP-handler extensions inside wp-content/uploads/.
• Deploy a web application firewall rule that blocks unauthenticated POST requests to admin-ajax.php with action=pafe_ajax_form_builder.

# Apache: deny execution of PHP-handler extensions in uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(phar|phtml|pht|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx: equivalent block inside the server context
location ~* /wp-content/uploads/.*\.(phar|phtml|pht|php[0-9]?|phps)$ {
    deny all;
    return 403;
}