{"vulnerability": "cve-2026-18351", "sightings": [{"uuid": "bfb687c8-f135-4e6a-85b3-497187843505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117244508969713610", "content": "CVE-2026-18351 (CRITICAL): addonsorg Drag and Drop File Upload for Elementor Forms <=1.6.0 lets unauthenticated attackers upload arbitrary files \u2014 enabling RCE. Restrict or disable plugin use until remediation. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsorg-drag-and-drop-file-158dc74bccbdf605 #OffSeq #WordPress #Vuln #RCE", "creation_timestamp": "2026-09-10T03:00:32.011643Z"}, {"uuid": "52e9c55f-4e02-461c-95cf-2dff82a0b74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18351", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mv52pwtwai25", "content": "Drag and Drop File Upload for Elementor Forms <=1.6.0 hit by CRITICAL CVE-2026-18351. Unauthenticated attackers can upload files & achieve RCE. Restrict plugin until patch confirmed. https://radar.offseq.com/threat/cve-2026-18351-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-addonsor...", "creation_timestamp": "2026-09-10T03:00:33.579856Z"}, {"uuid": "a29a0bdb-9e0a-492e-acce-f2375696cd8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv54wlmxuv2f", "content": "CVE-2026-18351 - drag and drop file upload for elementor forms\nThe Drag and Drop File Upload feature in the Elementor Forms plugin for WordPress, up through version 1.6.0, does not correctly verify the type of\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#addonsorg #CVE #infosec", "creation_timestamp": "2026-09-10T03:40:03.849005Z"}, {"uuid": "fdf10ff7-dd82-46f8-a008-92fa88c3e86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://gist.github.com/ichintu/d78ea836a25ff89ea1b8a699d08a5b4d", "content": "This threat intelligence brief covers two unauthenticated vulnerabilities published in September 2026:\n\n\u2022 **CVE-2026-18351 (CRITICAL, 9.8):** Affects the WordPress plugin *Drag and Drop File Upload for Elementor Forms* (\u22641.6.0). Flawed MIME validation allows unauthenticated arbitrary file uploads, enabling remote code execution (RCE).\n\n\u2022 **CVE-2026-59160 (HIGH, 8.8):** Affects the Node.js package *@yeger/turbo-graph* v2.8.8. Combines insecure network binding (`0.0.0.0`) with an unauthenticated API endpoint, allowing adjacent-network attackers to execute arbitrary tasks via CLI argument injection, potentially resulting in RCE and infrastructure compromise.\n\nBoth vulnerabilities require no authentication, though CVE-2026-59160 is limited to attackers on the same local network segment.", "creation_timestamp": "2026-09-10T04:01:24.927169Z"}, {"uuid": "23d74c6d-03c4-4c16-bcf8-1ca5e7c90d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv56hq45s22f", "content": "\ud83d\udea8 CVE-2026-18351 \u2014 CVSS 9.8 CRITICAL\n\nThe Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Uplo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-18351\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T04:07:32.712923Z"}, {"uuid": "81bc6cd2-1077-4c81-b5ba-b417d3cab937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101987", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Exploit-CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:30:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDrag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.\ud83d\udd25\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.368945Z"}, {"uuid": "fe45ed95-f018-44ff-917c-ee0d14f1484d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18351", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-18351\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 03:58:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-18351 \u2014 Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T08:00:08.420473Z"}]}