Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploite...

Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 File Upload...

CVE-2026-82901

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

CVE-2026-82901

The Ultra Addons for Contact Form 7 WordPress plugin (versions ≤ 3.5.50 ) is vulnerable to unauthenticated arbitrary file upload (CWE-434) due to insufficient validation in the uacf7_wpcf7_mail_components function. This flaw is specifically exploitable when the PDF Generator module is enabled (wh...

EUVD-2026-87790

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

CVE-2026-82901 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

PT-2026-99421

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Insufficient file type validation in the uacf7 wpcf7 mail components function allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to...

CVE-2026-82901: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7wpcf7mailcomponents' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrar...

WordPress Ultra Addons for Contact Form 7 plugin 3.2.4-3.5.50 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Jakub Herman in WordPress Plugin Ultimate Addons for Contact Form 7 versions 3.2.4-3.5.50...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

EUVD-2026-83502

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4-3.5.50 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation on file types and extensions in specific form fields. Attackers can upload files to a predictable public path with chosen extensions....

PT-2026-95755

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a...

CVE-2026-84750: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-12801: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

PT-2026-68851

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.44 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject...

CVE-2025-14356: Authorization Bypass Through User-Controlled Key

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7getgeneratedpdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level...