CVE-2026-84750

Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4–3.5.50 ) allows unauthenticated arbitrary file upload via its Signature Field , which does not validate file type or extension and stores uploads at a predictable public path with the attacker-chosen extension intact. On Debian/Ubun...