CVE-2026-84750 in Ultra Addons for Contact Form 7 Plugin
Summary
by MITRE • 09/19/2026
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The Ultra Addons for Contact Form 7 WordPress plugin version prior to 3.5.51 contains a critical input validation deficiency that allows unauthenticated attackers to upload arbitrary files directly onto the web server. This vulnerability stems from the failure of the application to properly validate file types or extensions during the upload process through its form fields. Instead of enforcing strict allowlists for acceptable file formats, the plugin accepts any file submitted by the user and stores it in a predictable public directory while preserving the original filename extension provided by the attacker. This lack of sanitization creates a direct pathway for malicious payloads to be placed within the web root or accessible subdirectories, bypassing standard security controls that rely on server-side configuration to restrict executable content.
The operational impact of this vulnerability is severe and varies based on the underlying web server configuration, primarily leading to either Remote Code Execution or Stored Cross-Site Scripting depending on how the hosting environment handles specific file extensions. On systems running Debian or Ubuntu with default Apache configurations, the PHP handler is configured to process files with .phar extensions in addition to standard executable types like .php and .phtml. Consequently, if an attacker uploads a crafted PHAR archive disguised as a legitimate data file but retaining its extension, the server will execute it as PHP code. This results in Remote Code Execution, granting the attacker full control over the web application and potentially the underlying operating system, leading to complete site takeover and compromise of sensitive data stored on the server.
In environments where the web server is configured more restrictively and only routes .php files to the PHP interpreter, the vulnerability still poses a significant risk through Stored Cross-Site Scripting. In this scenario, the uploaded file containing malicious JavaScript code is served directly from the site's origin without execution as backend code. However, because the script remains intact within the HTML response when users visit pages that display or reference these files, it executes in the context of the victim's browser session. This allows attackers to steal cookies, hijack user sessions, perform actions on behalf of authenticated users, and deface websites, effectively compromising the integrity and confidentiality of the application for all visitors who interact with the affected content.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the unrestricted upload of files with dangerous types, as well as CWE-20 regarding improper input validation. The exploitation technique maps to MITRE ATT&CK techniques such as T1505.003 for Server Side Request Forgery via web shell uploads and T1059.004 for Command Line Interface execution through PHP scripts. To mitigate this risk, administrators must immediately update the Ultra Addons plugin to version 3.5.51 or later where these validation checks have been implemented. Additionally, server-level hardening should be employed by ensuring that web directories do not execute scripts from upload folders and by configuring MIME type restrictions strictly at the web server level rather than relying solely on application-side logic for security enforcement.