The Ultra Addons plugin for Contact Form 7 has a flaw in the file upload validation routine used by the signature form field. Because the code performs insufficient checks on the MIME type and file extension, an unauthenticated user can upload any file to the server. The vulnerability is classified as CWE-434: Unvalidated File Extension or MIME Type. When a malicious file is accepted, the attacker can place executable code on the site, potentially enabling remote code execution. Only the PDF Generator feature, which is turned off by default, is necessary for the flaw to be active; without that module, the upload path is not exposed.

WordPress sites running the Ultra Addons for Contact Form 7 plugin from the Themefic vendor. Versions up to and including 3.5.50 are affected. The flaw exists in all releases where the PDF Generator module is enabled. Any site that has the plugin installed on a WordPress installation is vulnerable unless the module is disabled or the plugin is upgraded.

The flaw carries a high CVSS score of 9.8, indicating a critical severity. EPSS is not available, but the lack of authentication requirement and the potential for remote code execution make it attractive to attackers. The vulnerability is not listed in the CISA KEV catalog, so there is no confirmed exploit in the wild according to the current information. An attacker can exploit the flaw by sending a crafted request via the signature form field to upload a file to the server. When the PDF Generator module is active, this upload accepts arbitrary files, leading to a high chance of exploitation. Because the vector is unauthenticated, any publicly accessible site with the plugin can be targeted.