Ultimate Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later.
Affected component: Ultra Addons for Contact Form 7 (plugin)
Fixed in: 3.5.51
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 2, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.5.51 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-84750