CVE-2026-124218: Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter

Q: Which deployments are exposed to unauthenticated exploitation?

Deployments running any version through 1.6.2 are exposed when the "yeepdf_not_save" privacy option is enabled. This is described as a commonly used production setting and causes the vulnerable remove_files() cleanup path to be reached.

Q: Does an attacker need a WordPress account or user interaction?

No. The vulnerability is unauthenticated, and the supplied severity vector indicates no privileges or user interaction are required.

Q: What is the likely impact if exploitation succeeds?

An attacker can delete arbitrary files on the server because file paths are not sufficiently validated. Deletion of an important file, such as wp-config.php, can potentially lead to remote code execution.

Q: How can administrators assess whether their site is affected?

Verify whether the Drag and Drop File Upload for Elementor Forms plugin is installed at version 1.6.2 or earlier, then check whether the "yeepdf_not_save" privacy option is enabled. The described vulnerable cleanup path is reachable under that setting.

Published Nov 13, 2026

Updated

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removefiles function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the "yeepdfnotsave" privacy option is enabled, a commonly used production setting that triggers the removefiles() cleanup path.

Affected Software

1 affected component

Drag and Drop File Upload for Elementor Forms<=1.6.2

Event History

Nov 13, 2026

CVE Published

via MITRE·09:35 AM

Data Sourced

via MITRE·09:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Deployments running any version through 1.6.2 are exposed when the "yeepdf_not_save" privacy option is enabled. This is described as a commonly used production setting and causes the vulnerable remove_files() cleanup path to be reached.

Does an attacker need a WordPress account or user interaction?

No. The vulnerability is unauthenticated, and the supplied severity vector indicates no privileges or user interaction are required.

What is the likely impact if exploitation succeeds?

An attacker can delete arbitrary files on the server because file paths are not sufficiently validated. Deletion of an important file, such as wp-config.php, can potentially lead to remote code execution.

How can administrators assess whether their site is affected?

Verify whether the Drag and Drop File Upload for Elementor Forms plugin is installed at version 1.6.2 or earlier, then check whether the "yeepdf_not_save" privacy option is enabled. The described vulnerable cleanup path is reachable under that setting.

CVE-2026-124218: Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Does an attacker need a WordPress account or user interaction?

What is the likely impact if exploitation succeeds?

How can administrators assess whether their site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Does an attacker need a WordPress account or user interaction?

What is the likely impact if exploitation succeeds?

How can administrators assess whether their site is affected?