CVE-2026-82901— Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
Quick assessment
Affected
themefic Ultra Addons for Contact Form 7
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 “Ultra Addons for Contact Form 7” 在 3.5.50 及更早的所有版本中存在任意文件上传漏洞，原因是函数 中的文件类型验证不充分。未经身份验证的攻击者可借此在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。请注意：该漏洞仅在插件的 PDF 生成器模块被启用时才可被利用，而该模块默认处于禁用状态。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82901
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
Source: CVE Program / CVE List V5
Vulnerability Description
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themefic | Ultra Addons for Contact Form 7 | 0 ~ 3.5.50 | - |
|
II. Public POCs for CVE-2026-82901
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82901
请登录查看更多情报信息。
News Coverage for CVE-2026-82901 (1)
Other References for CVE-2026-82901 (6)
IV. Related Vulnerabilities
Same product: Ultra Addons for Contact Form 7
-
CVE-2026-84750
Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthen -
CVE-2026-12801
Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (C -
CVE-2025-14356
Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authoriz -
CVE-2025-6756
Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (C -
CVE-2025-6212
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenti
Same vendor: themefic
-
CVE-2026-95586
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.5 -
CVE-2026-15948
Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross- -
CVE-2026-28188
WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Cont -
CVE-2026-28186
WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access -
CVE-2026-27999
WordPress Tourfic plugin <= 2.23.1 - Broken Access Control v
Same weakness: CWE-434
-
CVE-2026-101071
Acrel Electric Unet Web Service Upload Endpoint upload unres -
CVE-2026-12269
Authenticated File Write to RCE via keepalived in DDI Centra -
CVE-2026-85134
Arbitrary File Upload Leading to Remote Command Execution in -
CVE-2026-94132
Joomla Extension - acymailing.com - Remote Code Execution vu -
CVE-2026-18143
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated A
V. Comments for CVE-2026-82901
No comments yet