DIRAS TAKE
Urgent: public exploit code is available for an unauthenticated file-upload flaw that can enable remote code execution if the PDF Generator module is enabled, so treat internet-facing sites with this plugin as high priority to mitigate.
What is CVE-2026-82901?
Unauthenticated attackers can upload files to sites running the Ultra Addons for Contact Form 7 WordPress plugin, potentially leading to remote code execution; tracked as CVE-2026-82901. The flaw affects 3.x branch releases 3.5.50 and earlier. Exploitation requires the plugin's PDF Generator module to be enabled on the target site (that module is off by default), and network access to the vulnerable WordPress instance is sufficient. The weakness is classified as CWE-434 (Unrestricted File Upload).
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Which versions of themefic Ultra Addons for Contact Form 7 are affected?
| BRANCH | AFFECTED | FIXED |
|---|---|---|
| 3.x | 3.5.50 and earlier |
Is CVE-2026-82901 being exploited?
Public exploit code is available.
How to fix CVE-2026-82901
- Disable the plugin's PDF Generator module immediately if it is enabled.
- Restrict access to WordPress admin and upload endpoints from untrusted networks and block unauthenticated access where possible.
- Monitor webserver and upload directories for unexpected files and review logs for suspicious POST requests to the plugin endpoints.
- Follow the vendor's guidance and install a vendor-supplied update once a fixed release is published.
Frequently asked questions
Is CVE-2026-82901 being actively exploited?
Public exploit code is available for CVE-2026-82901.
Which Ultra Addons for Contact Form 7 versions are affected by CVE-2026-82901?
The vulnerability affects the 3.x branch, specifically versions 3.5.50 and earlier.
Is there a patch for CVE-2026-82901?
No fixed release is listed for Ultra Addons for Contact Form 7 as of the provided information; monitor the vendor for an official update.
Does CVE-2026-82901 require authentication?
No. The issue can be exploited without authentication when the plugin's PDF Generator module is enabled.
References
- nvd.nist.gov/vuln/detail/CVE-2026-82901
- cve.org/CVERecord?id=CVE-2026-82901
- wordfence.com/threat-intel/vulnerabilities/id/872e1a05-aacc-44fa-93c1-8c3f7b2fb46d?source=cve
- plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L133
- plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L192
- plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/signature/ultimate-signature.php#L300
- plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php#L608
- plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php#L807
- plugins.trac.wordpress.org/changeset/3698232/ultimate-addons-for-contact-form-7
- All themefic CVEs on CVE Radar
- CVEs published in September 2026