WordPress Plugin Vulnerabilities

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Description

The plugin does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-addons-for-elementor-forms
Fixed in 1.0.8

References

CVE
CVE-2026-124814

Miscellaneous

Original Researcher
Mike Gozdiskowski
Submitter
Mike Gozdiskowski
Verified
Yes
WPVDB ID
85f2e67b-4c6d-4817-9e4d-ef62a7ddb081

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-11 (about 7 hours ago)

Other

Published
Title
Published
2024-05-22
Title
Hash Form – Drag & Drop Form Builder < 1.1.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution
Published
2025-12-19
Title
File Uploader for WooCommerce < 1.0.4 - Unauthenticated Arbitrary File Upload via add-image-data
Published
2024-12-06
Title
Import Export For WooCommerce <= 1.6.2 - Subscriber+ Arbitrary File Upload
Published
2020-08-24
Title
Autoptimize < 2.7.7 - Authenticated Arbitrary File Upload
Published
2024-08-27
Title
Funnelforms Free < 3.7.4.1 - Authenticated (Administrator+) Arbitrary File Upload