CVE-2026-84750

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51

Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a predictable public path with the attacker-specified extension. On systems using Debian or Ubuntu Apache packages, where the PHP handler maps .phar files to PHP, this can lead to Remote Code Execution and full site takeover. On hosts that only route .php files to the PHP handler, the uploaded script is served from the site origin, resulting in Stored Cross-Site Scripting (a vulnerability where malicious scripts are permanently stored on the target server and served to other users).

Recommendations Update Ultra Addons for Contact Form 7 to version 3.5.51 or later.