{"id":"CVE-2026-124814","kind":"vulnerability","aliases":["CVE-2026-124814"],"related":[],"title":"Ultimate Addons for Elementor Forms: unauthenticated file upload leads to code execution","description":"The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.","summary":"The Ultimate Addons for Elementor Forms WordPress plugin does not validate file extensions in its bundled upload field before version 1.0.8. An unauthenticated visitor can upload a PHP script and run it on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-file-upload-field","plugin-version-1.0.8-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Ultimate Addons for Elementor Forms plugin.\n- Look for a form with a file upload field built with this plugin's Elementor widget.","fix":"- Ultimate Addons for Elementor Forms: `1.0.8`","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","triaged_at":"2026-11-12T06:37:49+00:00","updated_at":"2026-11-12T06:37:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T06:37:49Z","model":"claude-haiku-5-5","output":{"fix":"- Ultimate Addons for Elementor Forms: `1.0.8`","reach":"internet","title":"Ultimate Addons for Elementor Forms: unauthenticated file upload leads to code execution","impact":"high","summary":"The Ultimate Addons for Elementor Forms WordPress plugin does not validate file extensions in its bundled upload field before version 1.0.8. An unauthenticated visitor can upload a PHP script and run it on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs PHP code on the web server.","analyst_note":"Confirm whether the bundled upload field is on by default and which form configuration exposes it; check the vendor changelog for the 1.0.8 fix.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Ultimate Addons for Elementor Forms plugin.\n- Look for a form with a file upload field built with this plugin's Elementor widget.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-version-1.0.8-or-later","no-file-upload-field"],"who_is_affected":"Sites running the Ultimate Addons for Elementor Forms plugin before 1.0.8 that include its bundled file upload field on a public page. The exposure comes from the upload field accepting any file type, so sites without that field or without the plugin can skip it. Whether a specific site is reachable depends on the form configuration, which the sources do not describe.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000763,"input_tokens":4545,"output_tokens":617,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124814':15A,18A '-2026':14A,17A '1.0.8':45B,69C 'achiev':97C 'addon':2A,27B,62C 'allow':85C 'arbitrari':90C 'bundl':40B,81C 'code':11A,99C 'cve':13A,16A 'elementor':4A,19B,29B,64C 'execut':12A,100C 'extens':37B,75C 'field':42B,84C 'file':7A,36B,78C,82C,91C 'form':5A,30B,65C 'host':23B 'lead':9A 'packag':20B 'php':52B,94C 'plugin':32B,67C 'proper':72C 'remot':98C 'run':55B 'script':53B,95C 'self':22B 'self-host':21B 'server':59B 'ultim':1A,26B,61C 'unauthent':6A,47B,86C 'upload':8A,41B,50B,77C,83C,89C 'user':87C 'valid':35B,73C 'version':44B 'visitor':48B 'wordpress':24B,31B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Addons for Elementor Forms plugin before 1.0.8 that include its bundled file upload field on a public page. The exposure comes from the upload field accepting any file type, so sites without that field or without the plugin can skip it. Whether a specific site is reachable depends on the form configuration, which the sources do not describe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","elementor","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124814':15A,18A '-2026':14A,17A 'addon':2A 'code':11A 'cve':13A,16A 'elementor':4A 'execut':12A 'file':7A 'form':5A 'lead':9A 'ultim':1A 'unauthent':6A 'upload':8A","search_b":"'1.0.8':45B 'addon':27B 'bundl':40B 'elementor':19B,29B 'extens':37B 'field':42B 'file':36B 'form':30B 'host':23B 'packag':20B 'php':52B 'plugin':32B 'run':55B 'script':53B 'self':22B 'self-host':21B 'server':59B 'ultim':26B 'unauthent':47B 'upload':41B,50B 'valid':35B 'version':44B 'visitor':48B 'wordpress':24B,31B","search_c":"'1.0.8':69C 'achiev':97C 'addon':62C 'allow':85C 'arbitrari':90C 'bundl':81C 'code':99C 'elementor':64C 'execut':100C 'extens':75C 'field':84C 'file':78C,82C,91C 'form':65C 'php':94C 'plugin':67C 'proper':72C 'remot':98C 'script':95C 'ultim':61C 'unauthent':86C 'upload':77C,83C,89C 'user':87C 'valid':73C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124814","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","fetched_at":"2026-11-12T06:36:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}