CVE WATCH / VULNERABILITY DETAIL
CVE-2026-124218
HIGHCVSS 8.2NVD feed
Published 13 November 2026 · tracked since 13 November 2026
Description
The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary f
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-129267 LOW 3.5
- CVE-2026-127115 MEDIUM 5.4
- CVE-2026-120687 HIGH 7.2
- CVE-2026-116753 HIGH 7.2
- CVE-2026-110531 MEDIUM 6.4
- CVE-2026-19907 CRITICAL 9.8
- CVE-2026-18053 HIGH 8.8
- CVE-2026-129433 CRITICAL 9.9
- CVE-2026-129254 MEDIUM 4.3
- CVE-2026-120522 CRITICAL 9.8