EUVD-2026-83502
GHSA-cq73-82v9-gx86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify vulnerable plugin form
-
DeliverySubmit form with .phar/.phtml payload
-
ExploitFile stored at predictable public path
-
ExecutionRequest uploaded file URL
-
PersistApache .phar handler executes PHP
-
ImpactDeploy web shell, full site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, user interaction, or special access required to upload - an unauthenticated remote attacker uploads an arbitrary file via a plugin form field because the plugin validates neither type nor extension and stores the file at a predictable public path with the attacker's extension intact. The RCE outcome specifically requires the host to run the default Debian/Ubuntu Apache PHP package configuration that maps .phar (alongside .php and .phtml) to the PHP handler; on such stacks exploitation is immediate and unauthenticated. Limiting factor for the RCE path: hosts that route ONLY .php to the PHP interpreter (or use hardened/PHP-FPM configs without the .phar mapping) instead serve the file inert, degrading impact to Stored XSS rather than code execution. Affected versions: Ultra Addons for Contact Form 7 from 3.2.4 up to (not including) 3.5.51. |
| Impact | This is a genuinely high-priority issue whose real-world severity exceeds its vendor-assigned CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the strongest possible exposure profile. However, the vendor's C:L/I:L/A:N impact metrics describe only the Stored XSS fallback outcome and materially understate the primary outcome: on the default Debian/Ubuntu Apache PHP packages (mod_php), the shipped handler maps .phar to the PHP interpreter, so the uploaded file executes and the result is unauthenticated Remote Code Execution with full site takeover - an impact set closer to C:H/I:H/A:H. A publicly available exploit exists (WPScan), which raises practical risk and lowers the barrier for opportunistic mass-scanning of WordPress sites. Countervailing signals: there is no EPSS score provided and no CISA KEV listing, so there is no evidence of confirmed active exploitation yet - status is 'publicly available exploit code exists,' which is distinct from in-the-wild use. The RCE-vs-XSS branch depends on the host's PHP handler configuration (Debian/Ubuntu Apache mod_php stack vs. .php-only routing / PHP-FPM), so impact is deployment-dependent. Net: treat as high priority for any WordPress host on Debian/Ubuntu Apache; the low CVSS understates the RCE path. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a form served by the plugin, attaching a malicious PHP payload with a .phar (or .phtml) extension, which the plugin stores unmodified at a predictable public URL. On a default Debian/Ubuntu Apache mod_php host the attacker then requests that URL, the .phar is executed as PHP, and they gain a web shell for full site takeover; on a .php-only host the same file is served with its script intact, yielding Stored XSS against site visitors. A public exploit is available via WPScan, and the low-complexity, no-auth, no-interaction vector makes this straightforward to automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.2.4 through before 3.5.51) lets a remote attacker place a file with an attacker-chosen name and extension at a predictable public path inside the WordPress site. On hosts running the default Debian/Ubuntu Apache PHP package configuration, where .phar is mapped to the PHP handler alongside .php and .phtml, that uploaded file is interpreted and the issue escalates to remote code execution and full site takeover; on hosts that route only .php to PHP, the file is served inert from the site's own origin, degrading the outcome to stored cross-site scripting. No authentication, user interaction, or special access is required (our assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and the RCE path is immediate on affected Apache/mod_php stacks - which is why our independent assessment rates real-world severity above the vendor-assigned CVSS 6.5.
RemediationAI
Vendor-released patch: upgrade Ultra Addons for Contact Form 7 to version 3.5.51 or later - this is the fixed release identified in the advisory data; update through the WordPress admin Plugins screen or WP-CLI and confirm the plugin version afterwards. If upgrading immediately is not possible, deactivate the plugin until patching is feasible (it is the vulnerable upload path, so removing it eliminates exposure at the cost of losing the affected form functionality). Because the RCE path depends on the server's PHP handler mapping, an effective compensating control is to remove .phar from the Apache PHP handler on Debian/Ubuntu (for example, drop the phar FilesMatch from the mod_php configuration and reload Apache), which reduces the worst case to stored XSS rather than code execution - the trade-off is that only web-serving of .phar files is affected, and legitimate applications do not normally need .phar execution over HTTP. Additionally, block uploads with executable/script extensions (.phar, .php, .phtml, .php5, .pht) at the WAF or reverse proxy, and disable script execution in the WordPress uploads directory via web server configuration (e.g., php_admin_flag engine off or an equivalent handler removal for that path); the trade-off is that some legitimate plugins generating downloadable files in uploads may break, so validate before enforcing site-wide. Monitor the WPScan advisory at https://wpscan.com/vulnerability/44f68354-4be3-422f-9f94-af980b2ebc44/ for updates, and treat any host that cannot be patched or reconfigured as requiring plugin deactivation rather than relying on detection alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): a form field exposed by the Ultra Addons for Contact Form 7 plugin accepts uploaded files without validating content type or file extension, and then writes them to a predictable, web-accessible location while preserving the attacker-supplied extension. Because the plugin performs no MIME/extension allow-listing and the storage path is guessable, an unauthenticated visitor can drop an arbitrary file - the readily available weaponization is a .phar payload - directly into a publicly reachable directory. The exploit chain then depends on server configuration rather than on the plugin: Debian and Ubuntu's packaged Apache mod_php setup includes a FilesMatch directive that hands .phar to the PHP interpreter together with .php and .phtml, so the uploaded .phar is executed server-side and produces remote code execution. Where the Apache configuration is hardened to map only .php (or where PHP-FPM/other handlers are used without a .phar mapping), the file is instead returned by the web server with its script content intact and executes in the victim's browser on the site's own origin, yielding stored cross-site scripting. The CPE supplied by the feed is a wildcard with an unknown vendor (cpe:2.3:a:unknown:ultra_addons_for_contact_form_7:*:*:*:*:*:*:*:*), reflecting that the affected component is the WordPress plugin distributed from the WordPress.org repository rather than a separately named vendor product; the vulnerability was reported by WPScan and tracked in the EU as EUVD-2026-83502.
Know when Ultra Addons For Contact Form 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network upload (AV:N/PR:N/UI:N); AC:H because code execution depends on the Debian/Ubuntu Apache .phar handler mapping; achieving that yields full webshell RCE (C:H/I:H/A:H).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every v
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permit
Exploit-DB