{"schemaVersion":1,"id":"CVE-2026-84750","requestedId":"CVE-2026-84750","aliases":[],"status":"published","rawState":"Deferred","rawSeverityStatus":"Deferred","duplicateOf":null,"indexable":true,"title":null,"description":"The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.","dates":{"published":"2026-09-19T06:00:14.931Z","modified":"2026-09-19T13:09:13.062Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"cve.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"nvd","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00445,"percentile":0.37101,"severity":"low","asOf":"2026-10-14T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-19T00:00:00.000Z","score":0.00203,"percentile":0.10572},{"date":"2026-09-20T00:00:00.000Z","score":0.00266,"percentile":0.18802},{"date":"2026-09-21T00:00:00.000Z","score":0.00266,"percentile":0.1875},{"date":"2026-09-22T00:00:00.000Z","score":0.00266,"percentile":0.18779},{"date":"2026-09-23T00:00:00.000Z","score":0.00266,"percentile":0.18784},{"date":"2026-09-24T00:00:00.000Z","score":0.00445,"percentile":0.35964},{"date":"2026-09-25T00:00:00.000Z","score":0.00445,"percentile":0.36056},{"date":"2026-09-26T00:00:00.000Z","score":0.00445,"percentile":0.36163},{"date":"2026-09-27T00:00:00.000Z","score":0.00445,"percentile":0.36186},{"date":"2026-09-28T00:00:00.000Z","score":0.00445,"percentile":0.36196},{"date":"2026-09-29T00:00:00.000Z","score":0.00445,"percentile":0.36223},{"date":"2026-09-30T00:00:00.000Z","score":0.00445,"percentile":0.3632},{"date":"2026-10-01T00:00:00.000Z","score":0.00445,"percentile":0.36364},{"date":"2026-10-02T00:00:00.000Z","score":0.00445,"percentile":0.36425},{"date":"2026-10-03T00:00:00.000Z","score":0.00445,"percentile":0.3647},{"date":"2026-10-04T00:00:00.000Z","score":0.00445,"percentile":0.3646},{"date":"2026-10-05T00:00:00.000Z","score":0.00445,"percentile":0.36483},{"date":"2026-10-06T00:00:00.000Z","score":0.00445,"percentile":0.36577},{"date":"2026-10-07T00:00:00.000Z","score":0.00445,"percentile":0.36652},{"date":"2026-10-08T00:00:00.000Z","score":0.00445,"percentile":0.36677},{"date":"2026-10-09T00:00:00.000Z","score":0.00445,"percentile":0.36724},{"date":"2026-10-10T00:00:00.000Z","score":0.00445,"percentile":0.36763},{"date":"2026-10-11T00:00:00.000Z","score":0.00445,"percentile":0.36803},{"date":"2026-10-12T00:00:00.000Z","score":0.00445,"percentile":0.36826},{"date":"2026-10-13T00:00:00.000Z","score":0.00445,"percentile":0.3692},{"date":"2026-10-14T00:00:00.000Z","score":0.00445,"percentile":0.37101}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00203,"percentile":0.10572},{"date":"2026-09-20T00:00:00.000Z","score":0.00266,"percentile":0.18802},{"date":"2026-09-21T00:00:00.000Z","score":0.00266,"percentile":0.1875},{"date":"2026-09-22T00:00:00.000Z","score":0.00266,"percentile":0.18779},{"date":"2026-09-23T00:00:00.000Z","score":0.00266,"percentile":0.18784},{"date":"2026-09-24T00:00:00.000Z","score":0.00445,"percentile":0.35964},{"date":"2026-09-25T00:00:00.000Z","score":0.00445,"percentile":0.36056},{"date":"2026-09-26T00:00:00.000Z","score":0.00445,"percentile":0.36163},{"date":"2026-09-27T00:00:00.000Z","score":0.00445,"percentile":0.36186},{"date":"2026-09-28T00:00:00.000Z","score":0.00445,"percentile":0.36196},{"date":"2026-09-29T00:00:00.000Z","score":0.00445,"percentile":0.36223},{"date":"2026-09-30T00:00:00.000Z","score":0.00445,"percentile":0.3632},{"date":"2026-10-01T00:00:00.000Z","score":0.00445,"percentile":0.36364},{"date":"2026-10-02T00:00:00.000Z","score":0.00445,"percentile":0.36425},{"date":"2026-10-03T00:00:00.000Z","score":0.00445,"percentile":0.3647},{"date":"2026-10-04T00:00:00.000Z","score":0.00445,"percentile":0.3646},{"date":"2026-10-05T00:00:00.000Z","score":0.00445,"percentile":0.36483},{"date":"2026-10-06T00:00:00.000Z","score":0.00445,"percentile":0.36577},{"date":"2026-10-07T00:00:00.000Z","score":0.00445,"percentile":0.36652},{"date":"2026-10-08T00:00:00.000Z","score":0.00445,"percentile":0.36677},{"date":"2026-10-09T00:00:00.000Z","score":0.00445,"percentile":0.36724},{"date":"2026-10-10T00:00:00.000Z","score":0.00445,"percentile":0.36763},{"date":"2026-10-11T00:00:00.000Z","score":0.00445,"percentile":0.36803},{"date":"2026-10-12T00:00:00.000Z","score":0.00445,"percentile":0.36826},{"date":"2026-10-13T00:00:00.000Z","score":0.00445,"percentile":0.3692},{"date":"2026-10-14T00:00:00.000Z","score":0.00445,"percentile":0.37101}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","evidence":[]},"exploits":[{"id":"REF_9BAE953CD626D090","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/44f68354-4be3-422f-9f94-af980b2ebc44/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"exploitSources":["reference"],"weaknesses":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/434.html","capec":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html"}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"ttp":{"capecs":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html","weaknessIds":["CWE-434"],"techniqueIds":["T1574.010"]}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","weaknessIds":["CWE-434"],"capecIds":["CAPEC-1"],"tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}],"countermeasuresByTactic":[{"tactic":"Harden","items":[{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"}]},{"tactic":"Detect","items":[{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"}]},{"tactic":"Restore","items":[{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"}]},{"tactic":"Model","items":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}]},"affected":[{"vendor":"unknown","product":"ultra addons for contact form 7","name":"Ultra Addons for Contact Form 7","label":"ultra addons for contact form 7","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≥ 3.2.4, < 3.5.51","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.2.4, < 3.5.51","eol":null},{"vendor":"wordpress","product":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","label":"ultimate-addons-for-contact-form-7","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"≥ 3.2.4, ≤ 3.5.50 (fixed in 3.5.51)","noFixRecorded":false,"fixedIn":"3.5.51"}],"versionsText":"≥ 3.2.4, ≤ 3.5.50 (fixed in 3.5.51)","eol":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/44f68354-4be3-422f-9f94-af980b2ebc44/","label":"wpscan.com/vulnerability/44f68354-4be3-422f-9f94-af980b2ebc44/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"],"sources":["cve.org","nvd"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b19085-4a7f-4554-bbad-46aa9ab10fc5","label":"www.wordfence.com/threat-intel/vulnerabilities/id/77b19085-4a7f-4554-bbad-46aa9ab10fc5","hostname":"www.wordfence.com","tags":["Vendor Advisory"],"sources":["wordfence"]}],"droppedReferenceCount":0,"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-19T06:00:14.931Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-19T13:09:13.062Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"default","profileName":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10},"appliedRules":["high-cvss-alone"]},"warnings":[],"meta":{"dataAsOf":"2026-10-14T22:41:32.923Z","stale":false,"partial":false}}