CVE-2026-82901 in Ultra Addons for Contact Form 7

Summary

An Arbitrary File Upload vulnerability exists in the Ultra Addons for Contact Form 7 plugin. This affects all versions up to, and including, 3.5.50 of the plugin for WordPress. Version 3.5.51 fixes it. There is no evidence of active exploitation for this vulnerability.

Affected and patched versions

Is my site vulnerable?

To determine if your WordPress site is affected by CVE-2026-82901, you need to check two specific conditions:

1. Plugin Version: Verify the installed version of the "Ultra Addons for Contact Form 7" plugin.

1. PDF Generator Module Status: This vulnerability is only exploitable if the plugin's PDF Generator module is enabled. This module is disabled by default.

If your site is running Ultra Addons for Contact Form 7 version 3.5.50 or earlier, and the PDF Generator module is enabled, your site is exposed to this vulnerability.

What an attacker actually does

An attacker exploits this vulnerability by uploading malicious files to a website running the affected Ultra Addons for Contact Form 7 plugin. This is possible because the plugin, specifically in its uacf7_wpcf7_mail_components function, does not adequately validate the type of files being uploaded. This insufficient validation allows an attacker to bypass security checks designed to restrict uploads to safe file types, such as images or documents.

The vulnerability is only exploitable when the plugin's PDF Generator module is active. This module is disabled by default, meaning a site administrator must have explicitly enabled it for the vulnerability to be present. If the PDF Generator module is active, an unauthenticated attacker, meaning someone who does not need to log in or have any special permissions on the website, can send a specially crafted request. This request includes a harmful file, such as a PHP script, disguised to appear as an acceptable file type.

Once the malicious file is successfully uploaded to the website's server, it can be accessed and executed by the attacker. This remote code execution capability allows the attacker to run arbitrary commands on the server, potentially leading to full control over the website. This could involve defacing the site, injecting malware, stealing sensitive data, or using the server to launch further attacks. The low attack complexity, lack of required privileges, and absence of user interaction make this a significant risk when the specific conditions for exploitation are met.

How to detect a compromise

Detecting a compromise related to CVE-2026-82901 involves looking for indicators of unauthorized file uploads and subsequent remote code execution. Since an attacker can upload arbitrary files, the primary indicators will be unusual files in unexpected locations.

1. Unusual files in upload directories: look for PHP files in the uploads folder that changed recently.

   find wp-content/uploads -type f -name "*.php*" -mtime -7

   This command searches for files ending with .php (or variants) in the wp-content/uploads directory that were modified within the last 7 days. Adjust -mtime as needed for your investigation window.

2. File content analysis: search the uploads folder for common malicious function calls.

   grep -r -E "eval\(|base64_decode\(|shell_exec\(|system\(|passthru\(|exec\(|proc_open\(|popen\(" wp-content/uploads/

   This command recursively searches for common malicious function calls within the wp-content/uploads directory.

These detection methods focus on identifying the artifacts of the arbitrary file upload and the subsequent execution of malicious code.

How to fix

Update Ultra Addons for Contact Form 7 to version 3.5.51 or later. If you cannot update straight away, the steps below reduce the risk and help you check whether the site was attacked.

1. Disable the PDF Generator Module: The vulnerability is only exploitable when the Ultra Addons for Contact Form 7 plugin's PDF Generator module is enabled. Disabling this module removes the attack vector.

1. Monitor for Plugin Updates: Regularly check the official WordPress plugin repository or the plugin developer's website for updates to "Ultra Addons for Contact Form 7". Apply any available updates as soon as they are released, as a patch may be issued in the future.

1. Consider Temporary Deactivation/Removal (If Module is Essential and No Patch Exists): If the PDF Generator module is essential for your site's functionality and no patch is available, consider temporarily deactivating or removing the "Ultra Addons for Contact Form 7" plugin until a secure version is released. Evaluate the impact of this on your site's operations before proceeding. If you deactivate the plugin, ensure you have an alternative solution for any critical functionality it provides.

1. Review and Clean Up: If you suspect a compromise, perform a thorough review of your site's files and database for any unauthorized changes or malicious code, following the detection steps outlined above. Remove any suspicious files immediately.

1. Implement Web Application Firewall (WAF) Rules: Configure your WAF to block suspicious file upload attempts and requests to execute files in non-standard locations, particularly within upload directories. While not a direct fix, a WAF can provide an additional layer of defense against exploitation.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-82901

• https://www.wordfence.com/threat-intel/vulnerabilities/id/872e1a05-aacc-44fa-93c1-8c3f7b2fb46d

• https://wordpress.org/plugins/ultimate-addons-for-contact-form-7/