Contact Form 7 Addons unauth RCE (CVE-2026-82901) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-82901 is a critical arbitrary file upload vulnerability in Ultra Addons for Contact Form 7 versions up to and including 3.5.50 that lets unauthenticated attackers plant executable files on the server, making remote code execution possible. No official patch is documented for the affected range, so treat any site running the plugin as exposed until a fixed release lands.

Overview

Ultra Addons for Contact Form 7 extends the popular Contact Form 7 plugin with extra form features. One of those features, the PDF Generator module, handles mail components through the uacf7_wpcf7_mail_components function. That function fails to properly validate uploaded file types, which means an attacker can send a crafted upload request and store a file of their choosing on the web server.

The vulnerable code path does not require a login, a valid nonce tied to a privileged user, or any victim interaction. The attacker only needs network access to the target site.

Impact

Successful exploitation lets an unauthenticated attacker write arbitrary files into a location the web server can reach. Uploading a PHP file turns that into remote code execution, which in practice means full control of the WordPress host: webshells, data theft, defacement, lateral movement into the internal network, and persistent backdoors. A CVSS score of 9.8 reflects that the attack is network-reachable, low complexity, and needs no privileges or user interaction.

One important caveat: the flaw is only reachable when the plugin’s PDF Generator module is enabled. That module ships disabled by default, which limits the blast radius but does nothing for sites that turned it on for invoice, ticket, or certificate generation.

Remediation and Mitigation

• Update Ultra Addons for Contact Form 7 to a version above 3.5.50 as soon as the vendor publishes one, and verify the changelog explicitly mentions this CVE.
• If no fixed version is available, disable the PDF Generator module immediately. If the site does not need it, deactivate and remove the plugin entirely.
• Audit wp-content/uploads and any writable directories for unexpected PHP or script files, and check for recently modified files that do not match known plugin or theme content.
• Add a web server rule to block execution of PHP inside upload directories where possible.
• Treat any site that ran the vulnerable version with the PDF module enabled as potentially compromised, and rotate WordPress salts, admin credentials, and any secrets stored on the host.

Sites that suspect compromise should review access logs for POST requests to plugin endpoints and consult breach reports and security news for related campaign activity.

Security Insight

This case echoes a familiar WordPress plugin pattern: a niche feature, off by default, hides a fully unauthenticated code execution path that most site owners never think to audit. The default-disabled status is cold comfort, because the sites most likely to enable PDF generation are exactly the ones handling customer data at scale. It also underscores that plugin feature modules deserve the same scrutiny as core authentication and upload handlers, rather than being treated as cosmetic add-ons.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs