CVE-2026-82901

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51

Description Insufficient file type validation in the uacf7 wpcf7 mail components() function allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution. This issue is only exploitable if the PDF Generator module is enabled, as it is disabled by default.

Recommendations Update the plugin to a version newer than 3.5.50. As a temporary mitigation, ensure the PDF Generator module remains disabled.