CVE-2026-84750: Ultra Addons Contact Form 7 RCE Vulnerability

CVE-2026-84750 Overview

CVE-2026-84750 is an unrestricted file upload vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin before version 3.5.51. The plugin fails to validate file type or extension on one of its form fields and stores uploaded files at a predictable public path with the attacker-supplied extension intact. Unauthenticated attackers can upload arbitrary files to affected sites. On Debian and Ubuntu Apache stacks, the default PHP handler maps .phar alongside .php and .phtml, so uploaded files execute as PHP and produce Remote Code Execution. On stacks that route only .php to the PHP handler, the same primitive results in Stored Cross-Site Scripting served from the site origin.

Critical Impact
Unauthenticated attackers can achieve full site takeover through Remote Code Execution on default Debian and Ubuntu Apache deployments, or Stored XSS elsewhere.

Affected Products

Ultra Addons for Contact Form 7 WordPress plugin versions before 3.5.51
WordPress sites running the plugin on Debian or Ubuntu Apache (RCE path)
WordPress sites running the plugin on other PHP handler configurations (Stored XSS path)

Discovery Timeline

2026-09-19 - CVE-2026-84750 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-84750

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw classified under [CWE-434]. One of the plugin's form field handlers accepts files without validating the MIME type, extension, or content signature. The handler writes files to a public directory using the attacker-controlled filename, preserving the original extension.

Exploitation requires no authentication and no user interaction. An attacker submits a crafted multipart request to a page containing the vulnerable form and specifies a filename with a server-executable extension such as .phar, .phtml, or a scripted .html payload. The outcome depends on how the web server maps extensions to interpreters.

On Debian and Ubuntu Apache installations, the default php.conf configuration binds the PHP handler to .php, .phtml, and .phar. A file uploaded with a .phar extension is executed by the PHP interpreter when requested, giving the attacker arbitrary code execution as the web server user. This enables full site takeover, webshell installation, and pivoting into adjacent hosts.

Root Cause

The root cause is missing server-side validation of the uploaded file's extension, MIME type, and content. The handler additionally trusts the client-supplied filename when persisting the file and does not enforce a randomized or extension-stripped filename at a non-executable storage path.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates any public page rendering a vulnerable Ultra Addons for Contact Form 7 form, submits a multipart POST request containing the malicious file, and then requests the file directly from its predictable public URL. On hosts that route .phar to PHP, the request executes the payload. On other hosts, the file is served with its script contents intact, enabling Stored XSS in the site origin.

No verified proof-of-concept code is published. See the WPScan Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2026-84750

Indicators of Compromise

Files with .phar, .phtml, .php, or double extensions (for example image.jpg.phar) present in the plugin's upload directory
HTTP POST requests to Contact Form 7 endpoints containing multipart uploads with executable file extensions
Outbound connections from the web server process to unfamiliar hosts shortly after form submissions
Unexpected PHP processes spawning shell utilities such as /bin/sh, wget, or curl

Detection Strategies

Inspect Apache and Nginx access logs for POST requests to wp-admin/admin-ajax.php or Contact Form 7 submission URLs followed by GET requests to .phar or .phtml files under wp-content/
Scan the WordPress wp-content/uploads tree for files whose extension resolves to a PHP handler under the active server configuration
Alert on new files written under public upload paths that contain PHP tags (<?php, <?=) or <script> markers

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads and plugin directories
Forward web server, PHP-FPM, and WordPress audit logs to a central data lake for correlation
Track process lineage where the web server user is the parent to identify webshell activity

How to Mitigate CVE-2026-84750

Immediate Actions Required

Update Ultra Addons for Contact Form 7 to version 3.5.51 or later on all WordPress instances
Audit wp-content/uploads for files with executable extensions and remove any unauthorized artifacts
Rotate WordPress administrator credentials and API keys if evidence of exploitation is found
Review Apache mods-enabled/php*.conf on Debian and Ubuntu hosts to confirm the mapped extensions

Patch Information

The plugin vendor addressed the issue in version 3.5.51. Upgrade through the WordPress plugin manager or WP-CLI. Consult the WPScan Vulnerability Advisory for advisory details.

Workarounds

Deactivate the Ultra Addons for Contact Form 7 plugin until the patched version is deployed
Remove .phar and .phtml from the Apache PHP handler mapping if they are not required by the application
Block execution of PHP within the uploads directory using an Apache .htaccess or Nginx location rule
Deploy a Web Application Firewall rule that rejects multipart uploads with executable extensions to Contact Form 7 endpoints

bash

# Apache: prevent PHP execution in the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx: equivalent block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}

# WP-CLI: upgrade the plugin
wp plugin update ultra-addons-for-contact-form-7 --version=3.5.51