CVE-2026-124218
Deferred Deferred - Pending Action

Arbitrary File Deletion in Drag and Drop File Upload for Elementor Forms

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the "yeepdf_not_save" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-124218
EUVD
EUVD-2026-124995

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
addonsorg Drag and Drop File Upload for Elementor Forms From 0 (inc) to 1.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Drag and Drop File Upload for Elementor Forms WordPress plugin up to version 1.6.2. It allows unauthenticated attackers to delete arbitrary files on the server due to insufficient validation in the remove_files function. This flaw is exploitable when the yeepdf_not_save privacy option is enabled, which is a common production setting.

Detection Guidance

Check if the Drag and Drop File Upload for Elementor Forms plugin version 1.6.2 or earlier is installed. Look for unauthorized file deletions or suspicious activity in server logs. Inspect the plugin's remove_files function for improper file path validation.

Impact Analysis

An attacker could delete critical files like wp-config.php, leading to remote code execution. This could compromise the entire WordPress site, allowing unauthorized access, data theft, or site takeover. The impact includes potential loss of website functionality and sensitive data exposure.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the plugin to version 1.6.3 or later immediately. Disable the plugin if not essential. Review server files for unauthorized deletions, especially wp-config.php. Monitor for signs of remote code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...