{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aultra_addonsfor_contact_form_7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ultra_addons:for_contact_form_7:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-100386"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ultra Addons for Contact Form 7 (\u003c= 3.5.54)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","vulnerability","directory-traversal"],"_cs_type":"advisory","_cs_vendors":["Ultra Addons"],"content_html":"\u003cp\u003eThe Ultra Addons for Contact Form 7 plugin for WordPress contains a directory traversal vulnerability in versions 3.5.54 and earlier. The flaw exists within the uacf7_wpcf7_mail_components function. Unauthenticated attackers can leverage this to read arbitrary files on the web server. Exploitation is contingent upon the PDF Generator addon being active and an administrator having configured a PDF body template for a specific contact form.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files from the server filesystem, potentially leading to the disclosure of sensitive information such as configuration files, environment secrets, or system credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory WordPress installations running the \u0026quot;Ultra Addons for Contact Form 7\u0026quot; plugin to identify versions 3.5.54 or older.\u003c/li\u003e\n\u003cli\u003eUpdate the plugin to a version released after 3.5.54 that addresses this vulnerability.\u003c/li\u003e\n\u003cli\u003eIf updating is not immediately possible, disable the PDF Generator addon or remove any active PDF body templates for contact forms as a temporary mitigation.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous requests to the WordPress plugins directory or patterns indicative of directory traversal (e.g., \u0026quot;../\u0026quot;) targeting plugin-specific parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T08:05:01Z","date_published":"2026-11-10T08:05:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ultra-addons-traversal/","summary":"The Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to directory traversal via the uacf7_wpcf7_mail_components function, allowing unauthenticated file disclosure when specific PDF generation features are enabled.","title":"Ultra Addons for Contact Form 7: Directory Traversal (CVE-2026-100386)","url":"https://feed.craftedsignal.io/briefs/2026-11-ultra-addons-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ultra_addons:for_contact_form_7:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}