CVE-2026-124814

CriticalCVSS 9.8/10Last modified Nov 12, 2026

Description

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-12481510.0The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-suppl CVE-2026-1248175.3The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthen CVE-2026-124826.5A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinf CVE-2026-124822The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthent CVE-2026-124837.5The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to CVE-2026-124833The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them t CVE-2026-1248343.7A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_CVE-2026-124847.8A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the publ CVE-2026-1248485.5Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other CVE-2026-1248510.0GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a s CVE-2026-1248507.3A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier v CVE-2026-1248528.8Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.