Field brief
CVE‑2026‑124814: Critical WordPress Plugin Vulnerability Still Unpatched
A high‑CVSS flaw in the Ultimate Addons for Elementor Forms plugin remains unaddressed by the vendor, leaving WordPress sites exposed to remote code execution.
A critical flaw in the Ultimate Addons for Elementor Forms WordPress plugin, CVE‑2026‑124814, remains unpatched by the vendor. The NVD record lists a CVSS score of 9.8 and notes that any version before 1.0.8 fails to validate uploaded file extensions, allowing unauthenticated users to upload PHP scripts and achieve remote code execution. No official vendor advisory or fixed version has been published, and the CISA KEV database does not list this CVE. WordPress sites running the affected plugin are therefore still at risk, and there is no evidence of active exploitation. Administrators should verify whether they use this plugin and, if so, upgrade to 1.0.8 or later. Until the vendor releases a patch, monitoring for suspicious file uploads and restricting upload permissions remains a prudent defense. NVD record
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.