Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-26T19:16:28.427Z",
  "pubdate": "2026-09-26T19:16:28.427Z",
  "executiveSummary": "The Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to an arbitrary file upload vulnerability. This security flaw stems from inadequate validation of file types within the plugin's PDF Generator module, which is an optional feature. Successful exploitation allows unauthenticated remote attackers to upload arbitrary files to the host server. This bypass of security controls creates a critical risk of Remote Code Execution (RCE), potentially leading to a full compromise of the WordPress site. The vulnerability affects all plugin versions up to and including 3.5.50. While the vulnerable functionality is disabled by default, environments with the PDF Generator module active are exposed to this risk. The exploit does not require authentication, making it a high-priority concern for administrators managing sites where this specific module is enabled.",
  "technicalDetails": "The vulnerability resides within the 'uacf7_wpcf7_mail_components' function of the Ultra Addons for Contact Form 7 plugin. The root cause is a failure to implement robust server-side file type verification during the file upload process associated with the plugin's PDF Generator module. Although intended to facilitate the generation of PDF documents from form submissions, the code fails to restrict the extensions or MIME types of incoming file streams.\nExploitation is contingent upon the PDF Generator module being manually enabled by the site administrator. Once active, an unauthenticated attacker can interact with the vulnerable component to submit malicious files. The attack flow involves the attacker crafting a request containing a malicious payload—such as a PHP web shell—disguised as a legitimate upload or manipulated to bypass simplistic client-side checks. Because the plugin processes these uploads without sufficient validation, the application writes the attacker-supplied file to the server's filesystem.\nUpon successful storage of the malicious file, an attacker can trigger the code execution by navigating to the file's URL path. Since the file is stored within a publicly accessible directory, the web server processes the execution of the injected script, granting the attacker the ability to execute arbitrary commands with the privileges of the web server user. This post-exploitation impact includes full system control, unauthorized data exfiltration, and potential lateral movement within the hosting environment. The absence of an authentication requirement for this endpoint significantly expands the attack surface, allowing remote exploitation from any network location with access to the web server's exposed interfaces. The vulnerability affects all versions up to and including 3.5.50."
}