---
id: "CVE-2026-124814"
page: "https://infrastack.ai/live/CVE-2026-124814"
kind: "vulnerability"
aliases: ["CVE-2026-124814"]
title: "Ultimate Addons for Elementor Forms: unauthenticated file upload leads to code execution"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-file-upload-field", "plugin-version-1.0.8-or-later"]
published_at: "2026-11-12T06:17:13+00:00"
first_seen_at: "2026-11-12T06:36:54+00:00"
updated_at: "2026-11-12T06:37:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124814", "first_seen_at": "2026-11-12T06:36:54+00:00"}]
exploit_sources: []
---

# Ultimate Addons for Elementor Forms: unauthenticated file upload leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-124814 (this .md is for agents)

The Ultimate Addons for Elementor Forms WordPress plugin does not validate file extensions in its bundled upload field before version 1.0.8. An unauthenticated visitor can upload a PHP script and run it on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Ultimate Addons for Elementor Forms plugin.
- Look for a form with a file upload field built with this plugin's Elementor widget.

## Fix

- Ultimate Addons for Elementor Forms: `1.0.8`

## Timeline

- 2026-11-12T06:36:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124814

## From the sources

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_