CVE-2025-6220: Ultimate Addons For Contact Form 7 RCE Flaw

CVE-2025-6220 Overview

CVE-2025-6220 is an arbitrary file upload vulnerability in the Ultra Addons for Contact Form 7 plugin for WordPress. The flaw affects all versions up to and including 3.5.12 and is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type]. The save_options function in UACF7_Settings.php fails to validate file types during option saves. Authenticated attackers with Administrator-level access can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the WordPress host.

Critical Impact
Authenticated administrators can upload executable PHP files through the plugin's settings handler, enabling remote code execution on the underlying web server.

Affected Products

Themefic Ultimate Addons for Contact Form 7 versions 3.5.12 and earlier
WordPress installations with the vulnerable plugin active
Sites where Administrator credentials are shared across multiple operators

Discovery Timeline

2025-06-18 - CVE-2025-6220 published to the National Vulnerability Database
Changeset 3288584 - Themefic releases plugin update through the WordPress plugin repository
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-6220

Vulnerability Analysis

The vulnerability resides in the save_options function defined in admin/tf-options/classes/UACF7_Settings.php between lines 894 and 920. The function accepts file uploads supplied through the plugin's option-saving routine without validating MIME types, extensions, or file contents. Because no allow-list filter is applied, an authenticated administrator can submit a file with an executable extension such as .php. The uploaded file lands within the WordPress directory structure and remains directly reachable by HTTP requests. Once reachable, the file executes under the PHP interpreter, granting the attacker arbitrary command execution within the web server's privilege context.

Root Cause

The root cause is missing file type validation [CWE-434]. The save_options handler trusts client-supplied input and writes files to disk without invoking WordPress core helpers such as wp_check_filetype_and_ext or restricting uploads to known-safe MIME types. The plugin also does not enforce a capability check beyond the existing admin context, so any account with the required option-management privilege can reach the sink.

Attack Vector

Exploitation requires Administrator-level authentication and is performed over the network through the plugin's settings interface. An attacker abuses a compromised admin account, an insider role, or a chained vulnerability that grants administrator privileges. The attacker submits a crafted multipart request to the plugin's option save endpoint with a PHP payload masquerading as a settings asset. After the file is written, the attacker requests the uploaded path directly to trigger code execution. Public technical details and a proof of concept are referenced in the GitHub PoC Repository and the Ryan Kozak CVE Analysis.

Detection Methods for CVE-2025-6220

Indicators of Compromise

Unexpected .php, .phtml, or .phar files written under wp-content/uploads/ or plugin asset directories owned by the Ultra Addons plugin.
POST requests to WordPress admin endpoints containing multipart file fields tied to uacf7 option save actions.
New administrator-initiated outbound connections from the web server shortly after settings page activity.
Web server logs showing direct GETs to recently created files in plugin upload paths.

Detection Strategies

Audit plugin upload directories for files whose extensions do not match expected media types declared by the plugin.
Correlate WordPress audit logs of save_options activity with file system creation events on the host.
Inspect HTTP request bodies for Content-Type: application/x-php or PHP opening tags inside fields submitted to admin-ajax handlers.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content tree to flag executable files written outside of patch windows.
Forward web server and WordPress audit logs to a centralized analytics platform for anomaly review.
Alert on PHP process spawns initiated from files located in upload directories, which should never execute server-side code under a hardened configuration.

How to Mitigate CVE-2025-6220

Immediate Actions Required

Update Ultra Addons for Contact Form 7 to the version published in WordPress Changeset 3288584 or later.
Rotate credentials for all WordPress administrator accounts and enforce multi-factor authentication on administrative logins.
Review plugin upload and asset directories for unauthorized files and remove any artifacts that do not match expected content.
Restrict administrator role assignment to the minimum number of operators required to manage the site.

Patch Information

Themefic addressed the missing file type validation in the plugin update tracked by WordPress Changeset 3288584. Administrators should upgrade through the WordPress plugin manager or by deploying the patched release from the official repository. Confirm successful upgrade by checking the installed plugin version is greater than 3.5.12. Detailed analysis is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate the Ultra Addons for Contact Form 7 plugin until the patched version is deployed.
Configure the web server to deny PHP execution within wp-content/uploads/ and other plugin asset paths.
Place a web application firewall rule in front of the WordPress admin interface to block multipart submissions containing PHP opening tags to plugin option endpoints.

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>