CVE-2026-82901

{
  "etk_id": "ETK-2026-1717",
  "cve_id": "CVE-2026-82901",
  "display_id": "CVE-2026-82901",
  "ghsa_id": "GHSA-m2gh-25xj-89p6",
  "euvd_id": "EUVD-2026-87790",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file upload in Ultra Addons for Contact Form 7",
  "summary": "Ultra Addons for Contact Form 7 versions through 3.5.50 can permit unauthenticated file uploads when its PDF Generator module is enabled. An attacker may place arbitrary files on the WordPress host, potentially leading to code execution depending on server configuration.",
  "mitigation": "Disable the PDF Generator module immediately unless it is required. Update the plugin to a vendor-confirmed patched release when available, and keep it at or above that release.",
  "vendor": "Themefic",
  "product": "ultimate_addons_for_contact_form_7",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.5.50"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ultra Addons for Contact Form 7",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0111,
  "epss_percentile": 0.6542,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 25.06034551666667,
  "t0_at": "2026-09-26T18:28:25.922000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T20:12:36.869921+00:00",
      "days": 19.072348934270835,
      "is_lower_bound": false,
      "measured_at": "2026-09-26T18:28:25.922000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-21T00:00:00+00:00",
      "days": -5,
      "is_lower_bound": false,
      "measured_at": "2026-09-26T18:28:25.922000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-82901"
    },
    "public_poc": {
      "at": "2026-09-26T21:11:27+00:00",
      "days": 0.1132069212962963,
      "is_lower_bound": false,
      "measured_at": "2026-09-26T18:28:25.922000+00:00",
      "url": "https://github.com/murrez/CVE-2026-82901"
    },
    "trigger_signal": {
      "at": "2026-09-21T00:00:00+00:00",
      "days": -5.769744467592592,
      "is_lower_bound": false,
      "measured_at": "2026-09-26T18:28:25.922000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-82901"
    }
  }
}