CVE-2026-82901 Scanner

Ultimate Addons for Contact Form 7 is a plugin used extensively with WordPress installations to enhance the functionality of the popular Contact Form 7 plugin. Developed by Themefic, it adds various features to extend form capabilities, like custom fields and file uploading. This plugin is primarily used by website developers and administrators who need additional flexibility in creating contact forms. It empowers users to create more interactive and customized form experiences for their site visitors. Ultimate Addons for Contact Form 7 is often utilized in a range of web environments, from personal blogs to large corporate sites requiring robust contact form solutions. The software's versatility and ease of use make it a popular choice among WordPress enthusiasts.

The vulnerability detected in Ultimate Addons for Contact Form 7 enables arbitrary file upload through the [uacf7_signature] field, especially when the PDF Generator module is enabled. This file upload bypasses file-type or extension validation, allowing potentially malicious files to be uploaded to the server. Attackers can exploit this flaw by posting unauthorized files to the unsecured REST feedback endpoint, which are then saved in a web-accessible directory. As a result, attackers can potentially upload executable files depending on server configuration, leading to more severe security issues. The vulnerability is known under CVE-2026-82901, highlighting its impact and documentation in security communities. This flaw, if left unpatched, poses a significant risk to the affected web application.

Vulnerability details reveal that every file submitted via the designated signature field is saved in the `wp-content/uploads/uacf7-uploads/` directory without proper validation. The core issue lies in the PDF Generator module failing to enforce strict MIME type and extension checks, allowing for arbitrary code or file injection. Malicious users can exploit this by uploading script files that the server might execute, depending on its configuration. The Contact Form 7 core script helps prevent some extensions from executing, but vulnerabilities still exist. The threat escalates with any server configurations that allow execution of files with non-standard PHP extensions. Sites running versions of the plugin up to 3.5.50 are vulnerable and should be updated immediately to prevent exploitation.

If exploited, this vulnerability allows unauthorized users to upload files into directories accessible via the web, leading to unauthorized content deployment. Potential adverse effects include XSS (Cross-Site Scripting) attacks, phishing attempts via planted files, or script execution when certain file types are executed. Additionally, if specific file types like .phtml or .phar are allowed, attackers can achieve remote code execution (RCE), escalating the attack's severity. The vulnerable plugin version exposes the site to these risks unless adequately patched or mitigated. Unauthorized uploads can also manipulate site behavior or compromise user data, making exploitation particularly hazardous for affected systems.

REFERENCES

• https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultra-addons-for-contact-form-7-plugin-3-2-4-3-5-50-unauthenticated-arbitrary-file-upload-vulnerability
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php
• https://nvd.nist.gov/vuln/detail/CVE-2026-82901