Unauthorized Data Access in Ultra Addons for Contact Form 7 Plugin by WordPress

CVE-2025-14356

What is CVE-2025-14356?

The Ultra Addons for Contact Form 7 plugin for WordPress presents a vulnerability that allows attackers with Subscriber-level access or higher to access unauthorized data. This issue arises from a missing capability check in the 'uacf7_get_generated_pdf' function. If the 'PDF Generator' and 'Database' addons are enabled, authenticated attackers can exploit this flaw to generate and retrieve PDF documents containing sensitive form submission data. Users should ensure all relevant updates are applied to mitigate potential risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References