The Ultra Addons for Contact Form 7 plugin for WordPress contains a flaw that allows authenticated users with Administrator privileges to upload files through the save_options endpoint without any file type validation. This lack of validation can result in arbitrary files being written to the server, creating a potential vector for remote code execution. The weakness is classified as CWE-434, which captures this type of uncontrolled upload.

Affected systems are sites running WordPress with the Ultra Addons for Contact Form 7 plugin from Themefic, versions up to and including 3.5.12. Any installation that has not been upgraded beyond those versions remains susceptible. No other plugins or products are listed as affected.

Risk and exploitability assessment reveals a CVSS score of 7.2, indicating high severity, and an EPSS score of <1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is via authenticated administrative access, where an attacker can use the plugin’s settings interface to deliver a malicious file. Once uploaded, if the file is executable or interpreted by the server, the attacker gains potential remote code execution capabilities.