POCBIT
Log inSign up
WordPresscritical

CVE-2026-82901 — Ultra Addons for Contact Form 7 Unauthenticated File Upload

September 26, 2026 · 123 views

Unauthenticated arbitrary file upload (CWE-434, CVSS 3.1 9.8 Critical) in Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50 via uacf7_wpcf7_mail_components in the PDF Generator addon — signature field copies files to wp-content/uploads/uacf7-uploads/ with weak validation. Requires PDF Generator enabled on a form with uacf7_signature. Fixed in 3.5.51+.

#wordpress#contact-form-7#uacf7#file-upload#unauthenticated#themefic

CVE:

CVE-2026-82901

Date:

2026-09-26

Severity:

CRITICAL

Exploit source

PoC code is available to registered members only.

Log inSign up

Description

Overview

CVE-2026-82901 affects Ultra Addons for Contact Form 7 (Themefic, slug ultimate-addons-for-contact-form-7) ≤ 3.5.50. The PDF Generator addon’s uacf7_wpcf7_mail_components handler allows unauthenticated arbitrary file upload (CWE-434). Uploaded signature files are copied to /wp-content/uploads/uacf7-uploads/ with weak validation, enabling RCE when PHP executes under uploads. CVSS 3.1 9.8 Critical (PR:N). Fix: > 3.5.51 (Wordfence / changeset 3698232).

Condition: PDF Generator module enabled on a Contact Form 7 form that includes uacf7_signature (module is off by default).

| | | |---|---| | Plugin | ultimate-addons-for-contact-form-7 | | Affected | ≤ 3.5.50 | | Fixed | 3.5.51+ | | Vector | CF7 REST feedback + signature file field | | Write path | wp-content/uploads/uacf7-uploads/ |

Open source PoC: https://github.com/murrez/CVE-2026-82901

PoC page: https://pocbit.org/pocs/cve-2026-82901

Bundled tool (Python 3)

pip install -r requirements.txt
python poc.py -u https://wordpress.example --mode check
python poc.py -u https://wordpress.example --mode check --form-url "https://wordpress.example/contact/"
python poc.py -u https://wordpress.example --mode exploit --form-url "https://wordpress.example/contact/"
python poc.py --list targets.example.txt --mode check -j 10

Asset discovery

body="/wp-content/plugins/ultimate-addons-for-contact-form-7"
body="uacf7" "wpcf7"

Impact

Internet-facing WordPress sites with UACF7 PDF Generator and signature fields may allow full site compromise without authentication.

Remediation

  1. Upgrade Ultra Addons for Contact Form 7 to 3.5.51 or newer.
  2. Disable PDF Generator until patched if upgrade is delayed.
  3. Hunt for unexpected .php under uacf7-uploads/.

Legal and ethical use

Authorized testing only. Do not upload webshells to third-party sites.

References