# CVE-2026-82901: Ultra Addons for Contact Form 7 - Arbitrary File Upload

> Live exploitation tracking for CVE-2026-82901 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-82901

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Themefic Ultra Addons for Contact Form 7
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** wordpress, cms

## Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.

## CrowdSec analysis

[CVE-2026-82901](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-82901) is a critical arbitrary file upload vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin, affecting versions up to and including 3.5.50. When the PDF Generator module is enabled, unauthenticated attackers can upload arbitrary files to the server, potentially leading to remote code execution and compromise of the affected site. The module is disabled by default.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-82901 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2026-82901 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target the public Contact Form 7 feedback endpoint at `/wp-json/contact-form-7/v1/contact-forms/{form_id}/feedback`, submitting a crafted multipart upload through a UACF7 signature field. The uploaded file may then be accessible under `/wp-content/uploads/uacf7-uploads/`.

## Timeline

- 2026-09-26: CVE Published. CVE-2026-82901 is published to NVD.
- 2026-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-82901 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-82901 for the first time.

## References

- https://github.com/advisories/GHSA-m2gh-25xj-89p6
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-82901.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-82901) follows observed exploitation activity for CVE-2026-82901. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.