CVE-2026-124814: Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Q: Which installations are affected?

WordPress sites using Ultimate Addons for Elementor Forms versions earlier than 1.0.8 are affected if they expose the plugin’s bundled file upload field.

Q: Does an attacker need an account or other authentication?

No. The issue is exploitable by unauthenticated users.

Q: What is the likely impact of successful exploitation?

An attacker may upload arbitrary files, including PHP scripts, and achieve remote code execution.

Q: What should be prioritized for remediation?

Update Ultimate Addons for Elementor Forms to version 1.0.8 or later. If updating cannot happen immediately, restrict access to or disable exposed file upload functionality.

Published Nov 12, 2026

Updated

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

WordPress sites using Ultimate Addons for Elementor Forms versions earlier than 1.0.8 are affected if they expose the plugin’s bundled file upload field.

Does an attacker need an account or other authentication?

No. The issue is exploitable by unauthenticated users.

What is the likely impact of successful exploitation?

An attacker may upload arbitrary files, including PHP scripts, and achieve remote code execution.

What should be prioritized for remediation?

Update Ultimate Addons for Elementor Forms to version 1.0.8 or later. If updating cannot happen immediately, restrict access to or disable exposed file upload functionality.

CVE-2026-124814: Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Event History

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or other authentication?

What is the likely impact of successful exploitation?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does an attacker need an account or other authentication?

What is the likely impact of successful exploitation?

What should be prioritized for remediation?