External risk intelligence

Ultra Addons for Contact Form 7 Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-82901

The vulnerability exists in a WordPress plugin used for contact forms, which are typically deployed on public-facing websites. While the specific vulnerable module requires manual activation, the plugin itself is designed to be internet-accessible as part of a public web service.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin could allow attackers to upload arbitrary files to your server, potentially leading to remote code execution. This issue is only exploitable if the plugin's PDF Generator module is enabled, which is disabled by default. The main concern is confirming the relevance and exposure of this module within your environment.

Vulnerability allows arbitrary file uploads on WordPress sites.
Important if the PDF Generator module is enabled.
Verify if the PDF Generator module is active.

Attack Path

How an attacker could exploit the issue

An attacker could upload arbitrary files to a WordPress site by exploiting a flaw in the Ultra Addons for Contact Form 7 plugin, provided the PDF Generator module is enabled. This could allow them to execute code on the server.

No authentication required.
Uploading a malicious file.
Remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

When the PDF Generator module is enabled, unauthenticated attackers could upload arbitrary files to the server. This could lead to remote code execution if an attacker can bypass file type restrictions and upload a malicious executable.

Arbitrary files could be uploaded to the server.
Uploads are possible when the PDF Generator module is enabled.
Remote code execution is a potential consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress security team or the application owner responsible for the Ultra Addons for Contact Form 7 plugin should prioritize identifying all instances where the PDF Generator module is enabled. Given the plugin's function, this likely resides within the web application infrastructure. The first step is to locate these installations, assess their reachability and criticality, and then engage the appropriate application owner to plan remediation, considering the module's default disabled state.

Application owners must verify module enablement.
Confirm reachability and business criticality first.
Coordinate remediation or module deactivation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ultra Addons for Contact Form 7 plugin?

It is an extension for the popular Contact Form 7 plugin within WordPress. Users install it to add specialized features—such as PDF generation or digital signatures—to their website contact forms, allowing for more dynamic data handling and document creation beyond standard form submissions.

What does CVE-2026-82901 mean for my site?

This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It means the plugin fails to properly check file types before saving them to the server. An attacker can use this flaw to store malicious scripts on your site, which may grant them the ability to execute unauthorized commands or control the server.

Does this vulnerability always put my site at risk?

No. The security flaw only exists when the specific PDF Generator module within the plugin is actively enabled. If the PDF Generator module is turned off—which is the default configuration for this plugin—the code path required to exploit this arbitrary file upload vulnerability is not reachable by an attacker.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal identifies this as an external risk. Because contact forms are designed to receive input from web visitors, they are inherently reachable from the internet. Since this plugin powers public-facing forms, any site running the enabled module is considered exposed to potential network-based attacks.

How should I respond to this threat?

First, audit your WordPress installations to identify any active uses of this plugin. Check the settings for the Ultra Addons plugin to determine if the PDF Generator module is currently enabled. If it is, and you do not require this functionality, disable the module immediately as an effective first step toward securing your environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.