CVE-2025-6220

The CVE-2025-6220 entry concerns the Ultra Addons for Contact Form 7 WordPress plugin (versions

CVE-2025-6220 Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...

CVE-2025-6220 Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveoptions' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and...

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options' vulnerability

Authenticated Administrator+ Arbitrary File Upload via 'saveoptions' vulnerability discovered by Ryan Kozak in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.12...

CVE-2025-6220

creationtimestamp| type| source ---|---|--- 2025-06-18 03:00:06+00:00| published-proof-of-concept| Telegram/uoYBKiuXn51hJnqtAHEC12cmvN8GwunxQwbHVt8gU3sEQo 2025-06-18 11:00:06+00:00| published-proof-of-concept| Telegram/sG5bEwqwg0wbu2257UAVP1n6oi1Vbx9RKpot1MOVJIWfY 2025-06-18 11:38:17+00:00|...

Exploit for Unrestricted Upload of File with Dangerous Type in Themefic Ultimate_Addons_For_Contact_Form_7

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noq...