Ultra Addons for Contact Form 7 - Arbitrary File Upload (CVE-2026-82901)

CVE-2026-82901 is a critical arbitrary file upload vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin, affecting versions up to and including 3.5.50. When the PDF Generator module is enabled, unauthenticated attackers can upload arbitrary files to the server, potentially leading to remote code execution and compromise of the affected site. The module is disabled by default.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-82901 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2026-82901 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target the public Contact Form 7 feedback endpoint at /wp-json/contact-form-7/v1/contact-forms/{form_id}/feedback, submitting a crafted multipart upload through a UACF7 signature field. The uploaded file may then be accessible under /wp-content/uploads/uacf7-uploads/.