The Drag and Drop File Upload for Elementor Forms plugin (versions up to 1.4.3) suffers from an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw allows an attacker to manipulate file paths to access or affect files outside the designated upload directory. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS v3.1 score is 8.6, reflecting a network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can be exploited remotely without authentication or user interaction to cause a high impact on availability, potentially disrupting the service or causing denial of service conditions. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor the vendor's communications for updates. No specific mitigations or workarounds are currently documented.