Ultimate Addons for Elementor Forms: file upload to RCE (CVE-2026-124814)
The Ultimate Addons for Elementor Forms WordPress plugin does not properly validate file extensions in its bundled file upload field. An unauthenticated user can upload a PHP script and achieve remote code execution. CVSS score: 9.8.
Checked in Shield: no
Who is affected
WordPress sites running Ultimate Addons for Elementor Forms before version 1.0.8 that use the bundled file upload field.
How to check
In the WordPress admin, open Plugins and find Ultimate Addons for Elementor Forms. If the version is below 1.0.8, it is vulnerable. It is also worth checking the uploads folder for unexpected PHP files.
How to fix
A fix is available: update the plugin to version 1.0.8 or later. If you cannot update right away, deactivate the plugin temporarily.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet. Source: NVD.
