CVE-2026-82901: Ultra Addons for Contact Form 7 Arbitrary File Upload

Overview

A critical arbitrary file upload vulnerability has been disclosed in Ultra Addons for Contact Form 7 (developed by Themefic), a popular add-on plugin for the widely used Contact Form 7 WordPress plugin. Tracked as CVE-2026-82901, the flaw stems from insufficient file type validation in the plugin's uacf7_wpcf7_mail_components function and allows unauthenticated attackers to upload arbitrary files to the server.

The vulnerability affects all plugin versions up to and including 3.5.50 and carries a CVSS score of 9.8 (Critical). Because no authentication is required to trigger the vulnerable code path, any remote attacker who can reach a vulnerable site's contact form can attempt exploitation. Successful exploitation can lead to remote code execution (RCE) if the uploaded file is placed in a web-accessible, PHP-executable directory.

The issue was reserved on 2026-08-31, published on 2026-09-26, and assigned by Wordfence. Credit for the discovery has been attributed to researcher Supakiad S. (m3ez). A public proof-of-concept exploit is already available, so organizations running this plugin should treat patching as urgent.

Technical Details

How It Works

The vulnerability lives in the plugin's optional PDF Generator module, which lets site owners attach a generated PDF (including a customer's digital signature) to Contact Form 7 submissions. The module handles a uacf7_signature field where submitted signature data is written to disk as a file.

The uacf7_wpcf7_mail_components function does not adequately validate the type of file being uploaded before saving it. As a result, an attacker can craft a form submission that supplies a malicious payload in place of a legitimate signature image, and the plugin will write it to /wp-content/uploads/uacf7-uploads/ — a directory that is web-accessible by default. If the uploaded file has an executable extension and the hosting environment allows PHP execution in the uploads directory, the attacker can then request that file directly via HTTP to achieve code execution.

Important exploitation condition: this flaw is only reachable when the plugin's PDF Generator module is enabled on a form. The module is disabled by default, which reduces the number of immediately exploitable sites — but any site that has turned it on to support signed PDF submissions (contracts, waivers, consent forms, etc.) is exposed with no authentication barrier at all.

Impact Assessment

Who Is At Risk

• WordPress sites running Ultra Addons for Contact Form 7 version 3.5.50 or earlier
• Sites that have enabled the plugin's PDF Generator addon on one or more Contact Form 7 forms (e.g., for signed waivers, contracts, applications, or consent forms)
• Shared hosting environments where PHP execution is permitted inside wp-content/uploads/, which significantly increases the likelihood that an uploaded payload can be executed directly

Potential Attack Chain

1. Reconnaissance — Attacker identifies a target site running the vulnerable plugin with PDF Generator enabled (e.g., via a form that requests a signature)
2. Malicious Upload — Attacker submits a crafted request to the uacf7_signature field, bypassing file type validation in uacf7_wpcf7_mail_components
3. File Placement — The malicious file is written to /wp-content/uploads/uacf7-uploads/
4. Web Shell Execution — If PHP execution is permitted in that directory, the attacker requests the uploaded file directly to execute code as the web server user
5. Post-Exploitation — From there, an attacker can pivot to read wp-config.php (database credentials), create rogue admin accounts, install backdoors, or use the compromised site for further campaigns

This maps to MITRE ATT&CK T1505.003 (Web Shell) and the broader T1505 (Server Software Component) technique, where adversaries deploy a persistent, HTTP-accessible component to maintain access and execute commands on a compromised server.

Mitigation

Immediate Actions

• Update Ultra Addons for Contact Form 7 to version 3.5.51 or later immediately — the fix is available now
• If an update cannot be applied right away, disable the PDF Generator module on all forms; the module is off by default, so sites that have never enabled it are not affected by this specific vector
• Audit /wp-content/uploads/uacf7-uploads/ for unfamiliar or recently modified files, including anything with a .php, .phtml, .phar, or other executable extension
• Review recent Contact Form 7 submissions for unusual signature-field payloads or unexpected file sizes

Detection Opportunities

• Monitor web server access logs for direct requests to files under wp-content/uploads/uacf7-uploads/, particularly requests for non-image file types
• Look for newly created files in the uploads directory that do not correspond to legitimate form activity
• Alert on outbound connections or process spawning originating from the PHP-FPM or Apache/Nginx worker user shortly after a contact form submission
• Check for unexpected new WordPress administrator accounts or modified core/plugin files, which can indicate post-exploitation activity

Defence-in-Depth

• Disable PHP execution inside wp-content/uploads/ via web server configuration (e.g., an .htaccess rule or Nginx location block) as a general best practice for all WordPress installations, regardless of this specific plugin
• Deploy a Web Application Firewall (WAF) rule set capable of inspecting multipart form uploads for disallowed MIME types and executable file signatures
• Keep all WordPress core files, themes, and plugins — not just this one — on a regular patch cadence, and subscribe to a vulnerability feed (e.g., Wordfence, WPScan) for early warning on plugin CVEs
• Apply the principle of least privilege to the web server process and restrict write access to only the directories that genuinely require it

References

• NVD — CVE-2026-82901
• Wordfence Threat Intelligence — CVE-2026-82901
• murrez/CVE-2026-82901 — Public Proof-of-Concept (GitHub)