Description

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T07:16:32.753Z",
  "pubdate": "2026-09-19T07:16:32.753Z",
  "executiveSummary": "The Ultra Addons for Contact Form 7 WordPress plugin, in versions prior to 3.5.51, contains a critical security vulnerability involving the lack of file type and extension validation during the upload process. This flaw allows unauthenticated attackers to upload arbitrary files to a predictable, public-facing directory on the web server.\nThe vulnerability stems from improper input sanitization and a failure to enforce file extension allowlisting. By successfully uploading malicious files, an attacker can achieve Remote Code Execution (RCE) on specific server configurations, such as those using Debian or Ubuntu Apache packages that map .phar extensions to the PHP interpreter. In environments where PHP execution is restricted to .php files, the vulnerability facilitates Stored Cross-Site Scripting (XSS) by serving the malicious script from the site's origin.\nGiven the ability to achieve full site takeover through RCE, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress installation. Exploitation does not require authentication, making it trivial for remote adversaries to execute arbitrary code or inject malicious scripts into the target environment. Immediate remediation is required to prevent unauthorized system access and data compromise.",
  "technicalDetails": "The vulnerability is classified as an Unrestricted File Upload flaw occurring within the form field handling logic of the Ultra Addons for Contact Form 7 plugin. The root cause is the absence of server-side validation regarding the MIME type, file signature, or file extension of user-supplied uploads. Furthermore, the application persists these files to a predictable public path without renaming them or stripping sensitive extensions, effectively granting the attacker control over the file content and its execution context.\nThe exploitation flow begins with an unauthenticated attacker identifying the plugin's file upload interface. The attacker crafts a request containing a malicious payload—such as a PHP webshell—with a sensitive extension. Because the plugin fails to enforce strict validation, the file is successfully saved to the server’s file system at a location discoverable via predictable naming conventions.\nThe subsequent impact is contingent upon the underlying server configuration. In environments utilizing default Debian or Ubuntu Apache deployments, the PHP handler is configured to process multiple extensions, including .phar, as executable scripts. An attacker uploading a file with a .phar extension can trigger Remote Code Execution by requesting the file directly via a web browser, leading to full server compromise, arbitrary command execution with the privileges of the web server process, and potential lateral movement within the hosting infrastructure.\nIn environments where the PHP interpreter is explicitly scoped only to .php extensions, the uploaded file cannot be executed on the server side. However, the flaw remains critical as it enables Stored Cross-Site Scripting (XSS). The uploaded file, containing malicious JavaScript, is served directly from the application's origin. When an unsuspecting user or administrator navigates to the URL of the uploaded file, the script executes within the context of the user's session. This allows for session hijacking, administrative action spoofing, unauthorized content modification, and the deployment of further client-side attacks.\nThe vulnerability affects all versions of the Ultra Addons for Contact Form 7 plugin prior to 3.5.51. Because the attack vector is network-reachable and requires no authentication or administrative privileges, it represents an extremely high-risk vector for automated exploitation and manual breach attempts against WordPress sites relying on this plugin for form functionality."
}