CVE-2026-84750: CWE-434 Unrestricted Upload of File with Dangerous Type in Ultra Addons for Contact Form 7
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
AI Analysis
Technical Summary
CVE-2026-84750 is an unrestricted file upload vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin versions >=3.2.4 and <3.5.51. The plugin fails to validate file types or extensions on uploads, storing files publicly with attacker-chosen extensions intact. On Debian and Ubuntu Apache stacks that map .phar files to the PHP handler, this vulnerability enables remote code execution and full site compromise. On other stacks that only execute .php files, the uploaded files can be served as scripts, resulting in stored cross-site scripting.
Potential Impact
Unauthenticated attackers can upload arbitrary files leading to remote code execution on vulnerable Debian and Ubuntu Apache environments due to .phar execution. This results in full site takeover. On other environments, the vulnerability allows stored cross-site scripting, which can be used to execute malicious scripts in users' browsers.
Mitigation Recommendations
Upgrade the Ultra Addons for Contact Form 7 plugin to version 3.5.51 or later where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the version range indicating the fix in 3.5.51.
CVE-2026-84750: CWE-434 Unrestricted Upload of File with Dangerous Type in Ultra Addons for Contact Form 7
Description
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
CVSS v3.1
Score 6.5medium
Affected software
Ultra Addons for Contact Form 7
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84750 is an unrestricted file upload vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin versions >=3.2.4 and <3.5.51. The plugin fails to validate file types or extensions on uploads, storing files publicly with attacker-chosen extensions intact. On Debian and Ubuntu Apache stacks that map .phar files to the PHP handler, this vulnerability enables remote code execution and full site compromise. On other stacks that only execute .php files, the uploaded files can be served as scripts, resulting in stored cross-site scripting.
Potential Impact
Unauthenticated attackers can upload arbitrary files leading to remote code execution on vulnerable Debian and Ubuntu Apache environments due to .phar execution. This results in full site takeover. On other environments, the vulnerability allows stored cross-site scripting, which can be used to execute malicious scripts in users' browsers.
Mitigation Recommendations
Upgrade the Ultra Addons for Contact Form 7 plugin to version 3.5.51 or later where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the version range indicating the fix in 3.5.51.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-02T09:27:10.811Z
- State
- PUBLISHED
Threat ID: 6aae2c6755bf5e2cf5363ad4
Added to database: 09/19/2026, 06:32:07 UTC
Last enriched: 09/19/2026, 06:47:22 UTC
Last updated: 09/20/2026, 03:51:50 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.