rootpwn

high · CVSS v3 6.5 · EPSS 0.00203

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 lacks proper file type and extension validation during unauthenticated up

Overview

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 lacks proper file type and extension validation during unauthenticated uploads. Files are stored at predictable public paths, which can lead to remote code execution on specific server stacks or stored cross-site scripting on others.

Description

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

Impact

This vulnerability impacts the integrity and availability of the WordPress site, potentially leading to complete system compromise via remote code execution depending on the server stack. Organizations running Debian or Ubuntu with default Apache configurations mapping .phar to PHP are at the highest risk for full site takeover. Other configurations may still suffer from Stored Cross-Site Scripting, affecting authenticated and unauthenticated visitors alike.

Remediation

Update the Ultra Addons for Contact Form 7 plugin to version 3.5.51 or later. Ensure that web server configurations strictly limit script execution within upload directories and disable the execution of non-standard script extensions like .phar where not required.

Risk context

The vulnerability carries a CVSS base score of 6.5 (High) due to the potential for severe impact depending on the environment, though current EPSS data indicates a relatively low exploitation probability at 0.00203. Remediation should be prioritized based on exposure and underlying server stack configurations.

Affected products

  • Ultra Addons for Contact Form 7 plugin

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.5
CVSS v4
—
EPSS
0.00203

cve wordpress plugin rce xss unauthenticated-upload

← All CVEs

Related CVEs

high

CVE-2026-82560

CVE-2026-82560 causes CPU and memory exhaustion in Perl's Pod::Text when processing deeply nested =over directives. The vulnerability leads to denial of service by exhausting system resources. It affects all installations using Pod::Text prior to version 6.1.1.

View analysis

high

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin prior to version 1.1.5 lacks proper authorization checks when updating its front-end proxy configuration. This flaw enables low-privileged authenticated users, such as subscribers, to redirect the proxy to arbitrary external hosts and serve unauthorized content under the trusted site origin.

View analysis

high

CVE-2026-85658

The ProfilePress plugin for WordPress contains an arbitrary shortcode execution vulnerability affecting versions up to and including 4.17.2. The issue occurs because user-supplied input is passed directly to the do_shortcode function without proper validation. This matters because authenticated low-privileged users can leverage this flaw to execute arbitrary shortcodes, potentially triggering unintended functionality within the site.

View analysis

high

CVE-2026-85680

The Ultimate Member WordPress plugin (v<2.13.1) fails to properly escape user‑supplied profile names, allowing unauthenticated attackers to inject JavaScript that runs when any visitor, including admins, view the profile. This flaw enables cross‑site scripting (XSS) without requiring authentication. It matters because any site using the vulnerable plugin can be compromised by a simple account registration.

View analysis