CVE-2026-82901

Published Sep 26, 2026

Last updated 2 days ago

CVSS critical 9.8
Rails

Overview

Description
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
Source
security@wordfence.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@wordfence.com
CWE-434

Social media

Hype score
Not currently trending

  1. 🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-97163 CVE-2026-18143 CVE-2026-82901 CVE-2026-85984 CVE-2026-94132 ..🧵👇

    @exploitgrid

    27 Sept 2026

    1906 Impressions

    2 Retweets

    22 Likes

    9 Bookmarks

    1 Reply

    0 Quotes

  2. 🔴 CVE-2026-82901 | CVSS 9.8 Critical WordPress Ultra Addons for Contact Form 7 eklentisinde, 3.5.50 ve önceki sürümleri etkileyen kritik bir dosya yükleme açığı (CVE-2026-82901) bulundu. CVSS 9.8 Critical. Kimlik doğrulaması gerektirmeyen saldırganlar, PDF Generat

    @ridvanyagli

    27 Sept 2026

    25 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. New vulnerability analysis & PoC live! 🔍 Deep dive into CVE-2026-82901 mechanics, details, and mitigation: 💻 https://t.co/aubZkLwGnG Feedback and reviews are always welcome. #VulnerabilityResearch #CyberSecurity #RedTeam #Exploit #CVE

    @murrezsec

    26 Sept 2026

    113 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. 🚨 ShinyHunters is bypassing WAFs to exploit Oracle PeopleSoft servers using URL-encoding tricks. Meanwhile, critical CVE-2026-82901 hits WordPress Ultra Addons with CVSS 9.8 file uploads. Check your web logs and patch now. #ThreatIntel #CyberSecurity #CVE https://t.co/h713Xbjp

    @Npj8448

    26 Sept 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.•CVE-2026-85984
  2. The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.•CVE-2026-18143
  3. OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.•CVE-2026-100551
  4. When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.•CVE-2026-93643
  5. An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.•CVE-2026-93647

References

Sources include official advisories and independent security research.