CVE-2026-84750: Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Which deployments face remote code execution rather than only stored cross-site scripting?
Deployments using the plugin with the default PHP handler configuration shipped by Debian and Ubuntu Apache packages are exposed to remote code execution, because those handlers map .phar files to PHP. On hosts that route only .php to PHP, uploaded content is served from the site origin and results in stored cross-site scripting instead.
Does an attacker need an account or other authentication to exploit this?
No. The vulnerable signature-field upload path can be used by unauthenticated users.
What version resolves the issue?
Upgrade the plugin to version 3.5.51 or later. Versions before 3.5.51 are affected.
How can I determine whether uploaded files could be executed as PHP?
Check the Apache/PHP handler mapping for the affected host. If .phar is mapped to the PHP handler, as in the default Debian and Ubuntu Apache package configuration described, an attacker-uploaded .phar file can be executed.