This vulnerability (CVE-2026-28192) affects Piotnet Addons For Elementor Pro versions up to 7.1.67 and involves an unauthenticated arbitrary file upload due to lack of proper restrictions on file types. The flaw is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). Exploitation could allow attackers to upload malicious files, potentially leading to full system compromise. The CVSS v3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no vendor remediation or patch is currently documented.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, which can lead to complete compromise of the affected system's confidentiality, integrity, and availability. This could enable remote code execution, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing strict file upload filtering and monitoring, disabling or restricting file upload functionality if possible, and applying other compensating controls to reduce exposure.