CVE-2026-82901 — Ultra Addons for Contact Form 7 Unauthenticated File Upload
September 26, 2026 · 1,520 views
Unauthenticated arbitrary file upload (CWE-434, CVSS 3.1 9.8 Critical) in Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50 via uacf7_wpcf7_mail_components in the PDF Generator addon — signature field copies files to wp-content/uploads/uacf7-uploads/ with weak validation. Requires PDF Generator enabled on a form with uacf7_signature. Fixed in 3.5.51+.
Description
Overview
CVE-2026-82901 affects Ultra Addons for Contact Form 7 (Themefic, slug ultimate-addons-for-contact-form-7) ≤ 3.5.50. The PDF Generator addon’s uacf7_wpcf7_mail_components handler allows unauthenticated arbitrary file upload (CWE-434). Uploaded signature files are copied to /wp-content/uploads/uacf7-uploads/ with weak validation, enabling RCE when PHP executes under uploads. CVSS 3.1 9.8 Critical (PR:N). Fix: > 3.5.51 (Wordfence / changeset 3698232).
Condition: PDF Generator module enabled on a Contact Form 7 form that includes uacf7_signature (module is off by default).
| | |
|---|---|
| Plugin | ultimate-addons-for-contact-form-7 |
| Affected | ≤ 3.5.50 |
| Fixed | 3.5.51+ |
| Vector | CF7 REST feedback + signature file field |
| Write path | wp-content/uploads/uacf7-uploads/ |
Open source PoC: https://github.com/murrez/CVE-2026-82901
PoC page: https://pocbit.org/pocs/cve-2026-82901
Bundled tool (Python 3)
pip install -r requirements.txt
python poc.py -u https://wordpress.example --mode check
python poc.py -u https://wordpress.example --mode check --form-url "https://wordpress.example/contact/"
python poc.py -u https://wordpress.example --mode exploit --form-url "https://wordpress.example/contact/"
python poc.py --list targets.example.txt --mode check -j 10
Asset discovery
body="/wp-content/plugins/ultimate-addons-for-contact-form-7"
body="uacf7" "wpcf7"
Impact
Internet-facing WordPress sites with UACF7 PDF Generator and signature fields may allow full site compromise without authentication.
Remediation
- Upgrade Ultra Addons for Contact Form 7 to 3.5.51 or newer.
- Disable PDF Generator until patched if upgrade is delayed.
- Hunt for unexpected
.phpunderuacf7-uploads/.
Legal and ethical use
Authorized testing only. Do not upload webshells to third-party sites.
References
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- WordPressCVE-2026-18143critical
CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.
- WordPressCVE-2026-84434critical
CVE-2026-84434 — Gravity Forms ≤ 3.1.0.4 Unauthenticated Arbitrary File Upload
Unauthenticated arbitrary file upload in **Gravity Forms** (≤ 3.1.0.4) abusing a hidden **File Upload** field (`upload_file`).
- WordPressCVE-2026-93399critical
CVE-2026-93399 — Bookly WordPress IDOR (Order Token Leak & Booking Rollback)
Bookly ≤ 28.2: unauthenticated IDOR on booking AJAX — bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; calendar export and rollback cancel non-completed bookings. CVSS 3.1 9.1 Critical (CWE-639).
- WordPressCVE-2026-104736critical
CVE-2026-104736 — LearnPress ≤4.4.10 Unauthenticated PHP Object Injection (checkout-email)
LearnPress WordPress LMS ≤4.4.10: guest lp-ajax=checkout stores checkout-email in LP session → maybe_unserialize on read (CWE-502). POP/RCE if gadgets exist. Fixed 4.4.11. Python PoC: check, exploit, course discovery, CHAINS.md. CVSS 9.8 Critical unauth.