CVE-2025-6220 is an arbitrary file upload vulnerability in the themefic Ultra Addons for Contact Form 7 WordPress plugin, affecting all versions up to and including 3.5.12. The vulnerability arises from missing file type validation in the 'save_options' function, allowing authenticated users with Administrator privileges or higher to upload files of dangerous types to the server. This could potentially lead to remote code execution on the affected site. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can upload arbitrary files to the affected WordPress site, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the site and potentially the underlying server. Since the vulnerability requires high privileges, exploitation is limited to users with administrative access, but the impact of successful exploitation is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to file uploads. Avoid using the affected plugin versions if possible or consider disabling the plugin temporarily. Do not rely on generic mitigations as this vulnerability specifically involves missing file type validation in the 'save_options' function.