CVE-2023-48777 is a critical (CVSS 9.9) unrestricted file upload flaw in the Elementor Website Builder plugin for WordPress, affecting versions 3.3.0 through 3.18.1. It needs a logged in account. Update Elementor beyond 3.18.1 and confirm the exact fixed release in the Patchstack advisory.
What's affected
- Elementor Website Builder (free), versions 3.3.0 through 3.18.1, per the NVD record.
- Source conflict on range: the record says through 3.18.1, while the linked Patchstack page address mentions plugin version 3.18.0. Use the record's wider range until you confirm the fixed release.
- The vector requires low privileges, so an account on the site is needed.
- Fixed version: not confirmed from a source we fetched, because the Patchstack page could not be retrieved. Anything after 3.18.1 is outside the stated range.
- Severity: the record gives CVSS 9.9, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring low privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is changed, meaning the impact can reach beyond the vulnerable component.
How to check if you're exposed
Elementor is a WordPress plugin, so the quickest check is the version on the Plugins screen or from WP-CLI on the server.
wp plugin list --fields=name,status,version | grep -i elementor
wp plugin get elementor --field=version
Anything at or below 3.18.1 is inside the range in the record. If you manage many sites, run the same command across each one, and check staging and forgotten test sites as well as production. A site with the plugin installed but deactivated is a smaller risk than an active one, yet it is still worth updating or deleting.
Because the range starts at 3.3.0, very old installs are covered too.
What to do now
- Update Elementor to the latest release and verify the version is above 3.18.1.
- Review user accounts and remove any you do not recognise, since the flaw needs a login.
- Search the uploads directory for files with executable extensions such as php that have no reason to be there.
- Restrict who can register or hold contributor level and higher roles on the site.
- Back up the site before updating, then retest key pages built with Elementor.
Why it matters
The class is CWE-434 (Unrestricted Upload of File with Dangerous Type). An upload feature accepted a file type it should have refused. On a web server that runs PHP, an uploaded script in a web reachable folder can be run, which is why this class often leads to full control of the site. The record gives the impact as high for confidentiality, integrity and availability, with a changed scope.
The account requirement is the main limit. On sites with open registration or many contributors, that limit is thin. Page builders are installed on millions of sites, so a flaw like this attracts attention. Patch first, then investigate your uploads folder.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a login required?
Yes. The vector shows low privileges required. Open registration or weak contributor accounts make it easier.
How do I know I am fixed?
Confirm the plugin version is newer than 3.18.1 and compare it with the first fixed release named in the Patchstack advisory.
Sources
Last reviewed: 19 October 2026.
