Paper/Archive/CVE-2026-124814

CVE-2026-124814

Unknown Ultimate Addons for Elementor Forms — Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 12.1.121 × 202.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Affected

ProductAffectedFixed inSource

Ultimate Addons for Elementor Forms< 1.0.81.0.8CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/85f2e67b-4c6d-4817-9e4d-ef62a7ddb081