Unauthorized Data Access in Ultra Addons for Contact Form 7 Plugin by WordPress
CVE-2025-14356
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 12 December 2025
What is CVE-2025-14356?
The Ultra Addons for Contact Form 7 plugin for WordPress presents a vulnerability that allows attackers with Subscriber-level access or higher to access unauthorized data. This issue arises from a missing capability check in the 'uacf7_get_generated_pdf' function. If the 'PDF Generator' and 'Database' addons are enabled, authenticated attackers can exploit this flaw to generate and retrieve PDF documents containing sensitive form submission data. Users should ensure all relevant updates are applied to mitigate potential risks.
Affected Version(s)
Ultra Addons for Contact Form 7 * <= 3.5.33