CVE-2026-82901: Ultra Addons File Upload (CVSS 9.8)

TL;DR - CVE-2026-82901 is a critical unauthenticated arbitrary file-upload vulnerability in Ultra Addons for Contact Form 7 through version 3.5.50. - Sites are exposed when the plugin’s PDF Generator module is enabled. - No confirmed public proof of concept or active exploitation is known. Disable the module or remove the plugin pending a verified fix.

What Is the Root Cause?

The reported root cause is insufficient validation of uploaded file types in the uacf7_wpcf7_mail_components function. In practical terms, the application does not adequately constrain the type of file accepted by the affected upload path. An attacker could use that gap to submit content that should have been rejected, including potentially executable server-side files.

The vulnerable code path is associated with the plugin’s PDF Generator functionality. NVD references identify relevant source files under addons/pdf-generator/pdf-generator.php, including references around lines 608 and 807 in the version 3.5.48 source tree. The referenced WordPress Trac pages returned HTTP 403 during retrieval, so the exact source statements and request format could not be independently reproduced from the available material.

The impact depends on deployment details. A file placed in a non-executable directory may still create persistence, defacement, data exposure, or operational risk. If an uploaded server-side script is reachable and executable by the web server, the result could escalate to remote code execution. That outcome is possible, not guaranteed for every installation.

Analyst’s Take: Treat the module state as the first exposure question, but do not use its default-disabled status as a substitute for containment. The available references do not establish the exact request format, while the unauthenticated upload path and possible code execution make version and configuration verification urgent.

What Happened?

CVE-2026-82901 affects the WordPress Ultra Addons for Contact Form 7 plugin. NVD describes insufficient file-type validation in the uacf7_wpcf7_mail_components function, allowing unauthenticated attackers to upload arbitrary files when the PDF Generator module is enabled. Depending on server configuration and where the file is stored, successful exploitation could enable remote code execution.

Field	Assessment
CVE ID	CVE-2026-82901
CVSS	9.8 Critical
CVSS vector	Not included in the available NVD record
Attack vector	Network, based on the unauthenticated WordPress plugin attack path
Authentication required	None
Affected versions	All versions up to and including 3.5.50
Patch available	No confirmed fixed version identified
Exploitation prerequisite	PDF Generator module enabled
CISA KEV status	Not listed

PDF Generator is disabled by default, which reduces exposure but does not eliminate the issue. Administrators should verify the module state on every installation rather than infer exposure from the plugin being installed.

Who Needs to Act?

Administrators should treat every installation of Ultra Addons for Contact Form 7 at version 3.5.50 or earlier as affected. The affected range is all plugin versions up to and including 3.5.50. Exposure requires the PDF Generator module to be enabled, and the module is reportedly disabled by default.

There is no confirmed fixed version in the available NVD record or retrieved primary references. The fix reported for CVE-2026-65439, version 3.5.46, is unrelated and must not be used as evidence that CVE-2026-82901 is remediated. Teams should verify the installed version and module state through WordPress administration, WP-CLI, deployment manifests, or the plugin’s official release information.

For asset inventory, identify both active and inactive copies. An inactive vulnerable plugin may become exposed during a later configuration change, restoration, or deployment. Sites that cannot verify PDF Generator is disabled should be handled as exposed until the plugin is removed or a vendor-confirmed fix is available.

Why Is the CVSS Score Critical?

NVD assigns CVE-2026-82901 a CVSS score of 9.8, classified as Critical. The available record does not include the CVSS vector string, so the precise official component values cannot be reproduced. The score is consistent with a remotely reachable vulnerability that requires no authentication and may affect confidentiality, integrity, and availability.

The practical severity comes from the combination of unauthenticated access and arbitrary file placement. An attacker does not need a WordPress account to attempt exploitation, and a successful upload may provide a foothold for further compromise. The potential for remote code execution explains why the impact is materially greater than a routine file-validation issue.

The default-disabled PDF Generator module is an important operational qualifier. CVSS scoring may describe the vulnerable product condition without reflecting every local configuration state. A site with the module disabled has a lower immediate attack surface, but administrators should still remove or patch the plugin because configuration drift, future enablement, or incomplete disabling could restore exposure.

Has CVE-2026-82901 Been Exploited?

No confirmed in-the-wild exploitation was identified in the available research. CVE-2026-82901 is not listed in CISA’s Known Exploited Vulnerabilities catalog, and there is no available evidence establishing use in ransomware campaigns or other confirmed attacks.

No verified public proof of concept was identified in the sources checked. The absence of a public PoC does not prove that exploitation is impossible or that private exploit code does not exist. The vulnerability remains operationally significant because the attack is unauthenticated and the potential impact includes arbitrary file placement and possible code execution.

Security teams should avoid conflating this CVE with CVE-2026-65439, a separate Ultra Addons for Contact Form 7 issue discussed in a July 2026 Sucuri roundup. That report refers to versions through 3.5.45 and a fix in 3.5.46, but it does not establish a fix for CVE-2026-82901.

How Do I Know If My Site Is Affected?

Start by inventorying the plugin version and checking whether PDF Generator is enabled. Review WordPress plugin settings, deployment configuration, and any module-specific configuration files. If the site may have been modified, compare the deployed plugin files with a trusted package and review recent administrative changes instead of relying solely on the WordPress dashboard.

Next, inspect web-server document roots, WordPress upload directories, and directories used by the plugin for unexpected files. Prioritize files with server-side executable extensions, recently modified files, files owned by the web-server account, and files that do not match the site’s normal upload patterns. Preserve suspicious files for analysis rather than opening them through the production web server. See our guide to forensic evidence preservation before collecting potentially relevant files or logs.

Technical Notes

The exact vulnerable request endpoint and parameter names were not established in the available references. Do not build a detection rule around an invented URI. Instead, correlate unauthenticated POST requests to the site with upload-related activity, plugin paths, and newly created files:

# Generic access-log pattern to investigate; adapt fields to your server format
"POST " 401/200/201
request_uri contains "/wp-content/plugins/ultimate-addons-for-contact-form-7/"
OR request_uri contains "uacf7"

For Apache or Nginx environments, search access logs for POST requests followed shortly by file creation or requests for newly created executable files. A useful starting point is:

grep -E '\"POST [^\"]*(uacf7|ultimate-addons-for-contact-form-7)' /var/log/nginx/access.log
find wp-content -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -30 -print

Adjust the search paths to the site’s actual document root and log locations. A match is an investigation lead, not proof of exploitation. Correlate timestamps, source IPs, HTTP status codes, user-agent strings, file hashes, and subsequent requests to uploaded files.

What Should I Do About CVE-2026-82901?

No vendor-confirmed patched version was identified in the available information. Administrators should not claim remediation by upgrading to 3.5.46 or another unverified release. Before re-enabling the functionality, confirm a fixed version through the official WordPress plugin listing, vendor release notes, or a security advisory that explicitly addresses CVE-2026-82901.

The immediate workaround is to disable PDF Generator. If that cannot be verified or reliably enforced, deactivate or remove Ultra Addons for Contact Form 7. Ensure that directories used for uploads cannot execute server-side scripts, and restrict WordPress administration to trusted networks or an administrative access gateway where possible.

Rotate WordPress administrator credentials if compromise is suspected, and use unique credentials stored in an approved password manager such as 1Password. Credential rotation does not replace file and log analysis when unauthorized uploads or execution are found.

Technical Notes

Use the plugin’s actual WordPress slug after verifying it in the site inventory. The expected slug is ultimate-addons-for-contact-form-7:

# Verify the installed plugin and version
wp plugin get ultimate-addons-for-contact-form-7 --field=version

# Immediate containment if the module cannot be disabled independently
wp plugin deactivate ultimate-addons-for-contact-form-7

If the plugin has been removed or deactivated, test forms and dependent workflows in staging before making additional changes. Do not use a generic wp plugin update command as evidence of a fix when no fixed version has been confirmed. Once an official fixed release is published, use a version-pinned update and verify the result:

wp plugin update ultimate-addons-for-contact-form-7 --version=<vendor-confirmed-fixed-version>
wp plugin get ultimate-addons-for-contact-form-7 --field=version

Replace the placeholder only with a version explicitly confirmed to fix CVE-2026-82901. After containment, review administrator accounts, scheduled tasks, modified PHP files, web-server configuration, and outbound connections for signs of follow-on compromise. If suspicious files or execution are found, isolate the host and begin incident response rather than treating the event as a routine plugin update.

Where This Information Comes From

The primary source is the NVD record for CVE-2026-82901, published and last modified on September 26, 2026. It identifies Ultra Addons for Contact Form 7, the affected function, the arbitrary file-upload condition, the affected version range, the PDF Generator prerequisite, and the 9.8 CVSS score.

NVD-listed source references point to the WordPress plugin’s version 3.5.48 source tree:

The available research also checked CISA KEV status and found no listing. The Sucuri July 2026 roundup is relevant only as a warning about a separate CVE and should not be used to infer a remediation version for this issue.

Until a fixed version is confirmed, disable PDF Generator first. Deactivate or remove the plugin where necessary, prevent script execution in upload locations, and monitor for unauthorized file creation and suspicious unauthenticated requests.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.