The Piotnet Addons for Elementor Pro plugin suffers from CWE-434: Unrestricted Upload of File with Dangerous Type. The vulnerability arises because the 'pafe_ajax_form_builder' function does not properly validate uploaded file types, relying on an incomplete blacklist that blocks only certain extensions (php, phpt, php5, php7, exe) but permits others that can be exploited for remote code execution, such as .phar and .phtml. This flaw allows unauthenticated attackers to upload arbitrary files to the server if the affected site has a file upload field in a form, potentially leading to full system compromise. The CVSS v3.1 score is 9.8 (critical), reflecting the ease of exploitation and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented.

An attacker can upload arbitrary files with dangerous extensions to the affected server without authentication, potentially enabling remote code execution. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further network pivoting. The vulnerability is critical due to the lack of authentication, ease of exploitation, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider removing or disabling file upload fields in forms created with the Piotnet Addons for Elementor Pro plugin to prevent exploitation. Monitoring for suspicious file uploads and restricting file execution permissions on upload directories may provide temporary risk reduction.