Unrestricted File Upload Vulnerability in Ultra Addons for Contact Form 7 Plugin by WordPress
CVE-2026-84750
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 September 2026
Badges
What is CVE-2026-84750?
The Ultra Addons for Contact Form 7 plugin for WordPress prior to version 3.5.51 has a significant security flaw where it fails to validate the type or extension of files uploaded via its forms. This allows unauthenticated users to upload arbitrary files, potentially leading to serious security breaches. The vulnerability is exacerbated by the default PHP handler settings in Debian and Ubuntu environments, which map .phar files to be executed as PHP, posing the risk of Remote Code Execution. In cases where the host server is configured to only execute .php files, the uploaded malicious file can be served with its script intact, resulting in Stored Cross-Site Scripting (XSS).
Affected Version(s)
Ultra Addons for Contact Form 7 3.2.4 < 3.5.51
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.