The vulnerability exists in the create_entry_el() function of the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress (up to and including version 1.5.1). This function reads the raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() function without validating that the file was legitimately uploaded. When no file is present in $_FILES, raw_value can be attacker-controlled via POST data. Because PHP's copy() accepts both local filesystem paths and URLs, an attacker can copy arbitrary files readable by the PHP process or supply a remote URL. Elementor Pro is required to trigger this code path, but the vulnerability lies entirely in the Contact Form Entries handler. The copied file is placed in a directory with a hashed name generated from uniqid() and rand(), which is not cryptographically secure and should not be relied upon as primary mitigation.

An unauthenticated attacker can exploit this vulnerability to copy arbitrary files from the server or remote URLs to a directory on the affected site. This can lead to disclosure of sensitive files readable by the PHP process. The impact is confidentiality loss (high), with no direct integrity or availability impact reported. The vulnerability requires Elementor Pro to be installed but does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the affected plugin and consider disabling it if possible. Monitor vendor channels for updates and apply official fixes once released. Do not rely on the hashed directory name as a security control.