The Ultra Addons for Contact Form 7 plugin before version 3.5.51 fails to validate the type or extension of files uploaded through a form field, storing them at a predictable public path with the attacker‑chosen extension intact. When the PHP handler maps a malicious file (e.g., .phar) to the PHP interpreter, the file executes and an unauthenticated user obtains full remote code execution. If the web server only routes .php to the PHP interpreter, the same file is returned to the client unchanged, resulting in stored cross‑site scripting.

All installations of Ultra Addons for Contact Form 7 versions prior to 3.5.51 are vulnerable. The flaw exists in the file upload field that accepts arbitrary files and stores them in a publicly accessible location.

The vulnerability is easily exploitable by any unauthenticated user who can access the implicated form. No authentication or privileged access is required. The likelihood of exploitation is high on hosting stacks that expose extensions such as .phar to the PHP interpreter, such as Debian and Ubuntu Apache deployments, where the mod_php or FPM mapping will execute the uploaded file and lead to a complete site takeover. On hosts that only map .php files to the PHP interpreter, the uploaded file is returned to the client unchanged, resulting in stored cross‑site scripting but not server‑side execution. EPSS data is not available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, but the vulnerability is considered high severity due to potential remote code execution and site compromise.