The vulnerability CVE-2025-49444 affects merkulove Reformer for Elementor versions up to 1.0.5. It allows an attacker to upload files of dangerous types without restriction, including web shells, which can be executed on the server. This results in a critical security risk as it can lead to remote code execution and full control over the affected system. The CVSS 3.1 base score is 10.0, reflecting the ease of exploitation and the severe impact on system security.

Successful exploitation of this vulnerability allows an unauthenticated attacker to upload and execute arbitrary code on the web server hosting the vulnerable plugin. This can lead to complete compromise of the server, including data theft, data modification, service disruption, and further network penetration. The impact is critical, affecting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload permissions, disable the vulnerable plugin if possible, and monitor for suspicious file uploads. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for an official patch or temporary mitigation.