CVE-2025-8081

Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

We have discovered 781,725 live websites that are affected by CVE-2025-8081.

Run a Free Instant Scan



Affected Software

Product  Elementor
Category Landing Page Builders
Vulnerable Domains781,725 live websites (30% of Elementor install base)
Vulnerable Versions
  • from 0 through 3.30.2
Vulnerable Versions Count286 versions ( 79% of all versions)


Common Weakness Enumeration

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')



Details

  • Published - Aug 12, 2025
  • Updated - Apr 8, 2026

Credits

  • Michael Mazzolini (finder)

Website Distribution by Country

Number of websites using CVE-2025-8081
United States168,416 websites


Germany75,666 websites
France45,126 websites
Italy38,347 websites
Brazil31,652 websites
GB30,431 websites
Spain29,126 websites
Poland27,035 websites
Russia25,901 websites
Netherlands21,044 websites

Website Distribution by TLD

Number of websites using CVE-2025-8081
.com301,930 websites
.de42,377 websites
.com.br29,073 websites
.it27,582 websites
.org26,711 websites
.ru21,034 websites
.pl20,575 websites
.nl18,441 websites
.fr18,436 websites
.co.uk16,172 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-8081

Top websites that are affected by CVE-2025-8081. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.io France***
**************.de Germany***
********.com United States*,***
**********.com United States*,***
**.***.br Brazil*,***
******.com United States*,***
*****.com United States*,***
*****.com United States*,***
*********.com United States*,***
**********.com United States*,***
See full domain list

FAQ

CVE-2025-8081 is Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elementor
A total of 781,725 websites have been identified as vulnerable to CVE-2025-8081, based on global website indexing conducted by WebTechSurvey.
The Elementor is affected by the CVE-2025-8081 vulnerability.
Elementor versions up to and including 3.30.2 are vulnerable to CVE-2025-8081.