This vulnerability in the Drag and Drop File Upload for Elementor Forms plugin permits unauthenticated attackers to upload files of dangerous types without restriction. Specifically, it enables uploading web shells to the web server, which can be used to execute arbitrary code remotely. The affected versions include all versions up to 1.5.3. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to upload a web shell, resulting in full remote code execution on the affected server. This compromises confidentiality, integrity, and availability of the system, potentially allowing complete system takeover and persistent control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict or disable the vulnerable plugin, and block file upload functionality if possible. Monitor for suspicious file uploads and consider implementing web application firewall rules to detect and block malicious uploads.