CVE-2026-124814— Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Quick assessment

Affected

Unknown Ultimate Addons for Elementor Forms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.0.8 版本之前的"Elementor Forms 终极插件”（Ultimate Addons for Elementor Forms）WordPress 插件中，其内置的文件上传字段未能正确验证上传文件的扩展名，导致未授权用户可以上传任意文件（例如 PHP 脚本），从而实现远程代码执行。

AI Predicted 9.8 Difficulty: Trivial Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Ultimate Addons for Elementor Forms	0 ~ 1.0.8	-

II. Public POCs for CVE-2026-124814

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124814

请登录查看更多情报信息。

Other References for CVE-2026-124814 (1)

https://wpscan.com/vulnerability/85f2e67b-4c6d-4817-9e4d-ef62a7ddb081/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-124814

Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total

CVE-2026-122003		Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
CVE-2026-110072		Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr
CVE-2026-110041		Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E
CVE-2026-106027		Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v
CVE-2026-110959		Descope < 1.2.0 - Unauthenticated Account Takeover
CVE-2026-119039		Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti
CVE-2026-118421		WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVE-2026-118531		Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
CVE-2026-123044		ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVE-2026-119040		Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
CVE-2026-76792		User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L
CVE-2026-121498		Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR
CVE-2026-123092		WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio
CVE-2026-124652		Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR
CVE-2026-124653		Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
CVE-2026-124647		TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie
CVE-2026-124648		TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key
CVE-2026-124815		Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions
CVE-2026-124817		Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification
CVE-2026-124665		Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v

IV. Related Vulnerabilities

Same vendor: Unknown