Reported by 2 outlets
Ultra Addons for Contact Form 7 ( https:// radar.offseq.com/threat/cve-20 26-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-i
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.07 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Analysis
Critical file-upload vulnerabilities affect Contact Form 7 extensions with CVSS scores near 9.8. The existing advisory tracks CVE-2026-82901 and CVE-2026-84750 in Ultra Addons for Contact Form 7 (vendor Themefic, versions ≤3.5.50) with RCE risk when the PDF Generator is enabled. A newer event references CVE-2026-94589 targeting Extensions For CF7 via radar.offseq.com. Both involve unrestricted upload of files with dangerous types (CWE-434). No patch confirmation is visible for the newer CVE, and the older advisory remains active. Organizations using these plugins should disable file upload features, review plugin versions, and apply vendor updates when available.
Timeline
-
original reporting
Ultra Addons for Contact Form 7 ( https:// radar.offseq.com/threat/cve-20 26-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-i
radar.offseq.com · 24d ago · September 19th, 2026
Ultra Addons for Contact Form 7 ( https:// radar.offseq.com/threat/cve-20 26-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-i
via Mastodon https://radar.offseq.com/threat/cve-2026-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-ultra-addons-for-contact-cea8950917a550ac
-
update from euvd.enisa.europa.eu
🚨 EUVD-2026-87790 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Ultra Addons for Contact Form 7 🏢 Vendor: Themefic 📅 Updated: 2026-09-26 📝 The Ultr
euvd.enisa.europa.eu · 17d ago · September 26th, 2026
🚨 EUVD-2026-87790 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Ultra Addons for Contact Form 7 🏢 Vendor: Themefic 📅 Updated: 2026-09-26 📝 The Ultr
via Mastodon https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87790
-
mentioned by radar.offseq.com
CVE-2026-82901: CRITICAL (CVSS 9.8) file upload vuln in Ultra Addons for Contact Form 7 (≤3.5.50). RCE risk if PDF Generator enabled (off by
radar.offseq.com · 17d ago · September 27th, 2026
-
mentioned by radar.offseq.com
CVE-2026-94589: CRITICAL RCE in Extensions For CF7 ( https:// radar.offseq.com/threat/cve-20 26-94589-cwe-434-unrestricted-upload-of-file-wi
radar.offseq.com · 4d ago · October 10th, 2026