CRITICAL

CVE-2026-82901

CVSS v3

9.8

CRITICAL

EPSS Score

1.1 %

exploit probability, as of 2026-09-27

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-09-26
Last Modified: 2026-09-26

Frequently asked questions

What is CVE-2026-82901?

Is CVE-2026-82901 actively exploited?

Active exploitation of CVE-2026-82901 has not been confirmed. Its EPSS score was 1.1% on 2026-09-27, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-82901?

CVE-2026-82901 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Is CVE-2026-82901 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database