CVE-2026-84750

Received Received - Intake

Arbitrary File Upload and RCE in Ultra Addons for Contact Form 7

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-84750

Affected Vendors & Products

Vendor	Product	Version / Range
ultra_addons	contact_form_7	to 3.5.51 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Ultra Addons for Contact Form 7 WordPress plugin before version 3.5.51. It allows unauthenticated users to upload arbitrary files without validating the file type or extension. These files are stored at a predictable public path with the original extension intact. On Debian and Ubuntu Apache stacks, uploaded .phar files are executed as PHP, leading to remote code execution and full site takeover. On other stacks, the files are served with malicious scripts intact, causing stored cross-site scripting.

Detection Guidance

Check for uploaded files in the plugin's upload directory, typically under /wp-content/uploads/ultra-addons/. Look for unexpected file extensions or files with .phar, .php, or .phtml extensions. Review server access logs for suspicious upload requests to the vulnerable form field.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially gaining control over your website or executing arbitrary code. If your server runs Debian or Ubuntu with default Apache settings, the impact is severe as it allows full site takeover. Otherwise, it may lead to stored cross-site scripting attacks, compromising user data or spreading malware.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, unauthorized modifications, or disclosure of personal health information, leading to legal penalties and reputational damage.

Mitigation Strategies

Update the Ultra Addons for Contact Form 7 plugin to version 3.5.51 or later. If immediate update is not possible, disable file uploads in the plugin settings or restrict upload permissions. For Apache servers on Debian/Ubuntu, ensure .phar files are not mapped to PHP execution.

Hi! I’m here to help you understand CVE-2026-84750. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70