Executive brief
Ultimate Addons for Contact Form 7 is a WordPress plugin that extends contact form functionality. The plugin fails to validate file uploads in its signature field, allowing unauthenticated attackers to upload files with arbitrary extensions to predictable public paths. On servers configured to execute .phar files as PHP (default on Debian/Ubuntu), this leads to remote code execution and complete site compromise; on other configurations, attackers can upload malicious scripts that are executed in users' browsers.
Technical details
The plugin lacks file type and extension validation on uploads processed through its signature form field, storing files at predictable locations with attacker-controlled extensions. On Debian/Ubuntu Apache stacks where .phar maps to the PHP handler, arbitrary code execution is possible; elsewhere, stored XSS results when scripts are served from the site's origin. The vulnerability affects versions 3.2.4 through 3.5.50 and is fixed in 3.5.51.
Affected products
- Ultimate Addons for Contact Form 7 Ultimate Addons for Contact Form 7 3.2.4 through 3.5.50; fixed in 3.5.51
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Version 3.5.51 released