CVE-2026-124814 Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

CriticalCVSS 9.8

Published: 2026-11-12 08:00
Updated: 2026-11-12 14:18
Exploit status: No public exploit known

Description

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Affected products

No affected product data has been published yet.

References

wpscan.com exploit technical-description vdb-entry

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.