Ultra Addons for Contact Form 7: Directory Traversal (CVE-2026-100386)

The Ultra Addons for Contact Form 7 plugin for WordPress contains a directory traversal vulnerability in versions 3.5.54 and earlier. The flaw exists within the uacf7_wpcf7_mail_components function. Unauthenticated attackers can leverage this to read arbitrary files on the web server. Exploitation is contingent upon the PDF Generator addon being active and an administrator having configured a PDF body template for a specific contact form.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the server filesystem, potentially leading to the disclosure of sensitive information such as configuration files, environment secrets, or system credentials.

Recommendation

• Inventory WordPress installations running the "Ultra Addons for Contact Form 7" plugin to identify versions 3.5.54 or older.
• Update the plugin to a version released after 3.5.54 that addresses this vulnerability.
• If updating is not immediately possible, disable the PDF Generator addon or remove any active PDF body templates for contact forms as a temporary mitigation.
• Audit web server access logs for anomalous requests to the WordPress plugins directory or patterns indicative of directory traversal (e.g., "../") targeting plugin-specific parameters.