{"metadata": {"vulnerability": "CVE-2026-82901", "count": 32, "kinds": {"milestone": 4, "sighting": 18, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-08-31T09:23:20.843Z", "date_only": false, "value": "2026-08-31T09:23:20.843Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-82901", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-31T09:38:35Z", "date_only": false, "value": "2026-08-31T09:38:35.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-82901", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-09-26T06:02:31Z", "date_only": false, "value": "2026-09-26T06:02:31.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-82901", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-09-26T18:28:25.922Z", "date_only": false, "value": "2026-09-26T18:28:25.922Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-82901", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-26T18:28:25.922Z", "date_only": false, "value": "2026-09-26T18:28:25.922Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-82901", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T19:16:28Z", "date_only": false, "value": "2026-09-26T19:16:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M2GH-25XJ-89P6", "record": "GHSA-M2GH-25XJ-89P6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-26T19:16:28.427Z", "date_only": false, "value": "2026-09-26T19:16:28.427", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82901", "record": "FKIE_CVE-2026-82901", "field": "published"}, {"timestamp": "2026-09-26T20:08:01.900Z", "date_only": false, "value": "2026-09-26T20:08:01.900005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwh3lwtfdr2y", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "af1e4004-e386-4263-bce8-f942ad879b85", "content": "\ud83d\udea8 CVE-2026-82901 \u2014 CVSS 9.8 CRITICAL\n\nThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-82901\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwh3lwtfdr2y"}, {"timestamp": "2026-09-26T20:42:06.935Z", "date_only": false, "value": "2026-09-26T20:42:06.935187Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d6e4y6mor2wjq", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "1fa3f49f-0438-4028-8bb8-c5c482e1d067", "content": "CVE-2026-82901 - Ultra Addons for Contact Form 7\nCVE ID : CVE-2026-82901\n \n Published : Sept. 26, 2026, 7:16 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file t...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/d6e4y6mor2wjq"}, {"timestamp": "2026-09-26T21:04:23.722Z", "date_only": false, "value": "2026-09-26T21:04:23.722751Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwh6qpmljg2t", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "db6dde66-c2e6-4a98-b690-2efeca82015c", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cUltra Addons for Contact Form 7\u300d\u3067\u3001PDF\u751f\u6210\u30e2\u30b8\u30e5\u30fc\u30eb\u6709\u52b9\u6642\u306b\u4e0d\u5341\u5206\u306a\u30d5\u30a1\u30a4\u30eb\u7a2e\u5225\u691c\u8a3c\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u53ef\u2026\nCVE-2026-82901 CVSS 9.8 | CRITICAL", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mwh6qpmljg2t"}, {"timestamp": "2026-09-26T21:30:27Z", "date_only": false, "value": "2026-09-26T21:30:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M2GH-25XJ-89P6", "record": "GHSA-M2GH-25XJ-89P6", "field": "published"}, {"timestamp": "2026-09-26T21:30:27Z", "date_only": false, "value": "2026-09-26T21:30:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M2GH-25XJ-89P6", "record": "GHSA-M2GH-25XJ-89P6", "field": "modified"}, {"timestamp": "2026-09-26T22:00:08Z", "date_only": false, "value": "2026-09-26T22:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103477", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "af1e4ee9-4ec7-4d89-9b84-1314b98a907b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-82901\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 21:12:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 \u22643.5.50 unauth file upload via signature field when PDF Generator is enabled \u2192 wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103477"}, {"timestamp": "2026-09-26T22:00:08Z", "date_only": false, "value": "2026-09-26T22:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103477", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "72130f1c-e3a7-4fc1-9401-cf12f0f49b14", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-82901\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 21:12:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 \u22643.5.50 unauth file upload via signature field when PDF Generator is enabled \u2192 wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103477"}, {"timestamp": "2026-09-26T22:30:07.380Z", "date_only": false, "value": "2026-09-26T22:30:07.380466Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhdjzmyib26", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "4256c7c0-6ed3-4dbd-9762-e51bd1b2581c", "content": "CVE-2026-82901 - ultra addons for contact form 7\nThe Ultra Addons for Contact Form 7 plugin for WordPress can let anyone upload files to your server when its PDF Generator feature is turned on. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#themefic #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhdjzmyib26"}, {"timestamp": "2026-09-26T22:44:38.206Z", "date_only": false, "value": "2026-09-26T22:44:38.206067Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-82901", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-26T22:44:38.206Z", "date_only": false, "value": "2026-09-26T22:44:38.206067Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82901", "record": "FKIE_CVE-2026-82901", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-26T22:51:16.926Z", "date_only": false, "value": "2026-09-26T22:51:16.926Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-82901", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T22:51:16.926Z", "date_only": false, "value": "2026-09-26T22:51:16.926Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-82901", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T23:47:05.876Z", "date_only": false, "value": "2026-09-26T23:47:05.876682Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwhhtmuimw2c", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "676fcdc5-6b1a-411f-ae14-fd9ebbe8f3df", "content": "\ud83d\udd34 CVE-2026-82901 - Critical (9.8)\n\nThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload d...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82901/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwhhtmuimw2c"}, {"timestamp": "2026-09-27T00:00:35.354Z", "date_only": false, "value": "2026-09-27T00:00:35.354307Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117340060673817158", "record": "cve-2026-82901", "field": "creation_timestamp", "uuid": "78f17c39-4ebf-4d65-85d3-e340f5b8b75e", "content": "CVE-2026-82901: CRITICAL (CVSS 9.8) file upload vuln in Ultra Addons for Contact Form 7 (\u22643.5.50). RCE risk if PDF Generator enabled (off by default). Disable/monitor plugin & watch for patches. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra-addons-for-77a59cd90a3fbad1 #OffSeq #WordPress #Infosec #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117340060673817158"}, {"timestamp": "2026-09-27T00:00:37.509Z", "date_only": false, "value": "2026-09-27T00:00:37.509728Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwhiltdqgj2m", "record": "cve-2026-82901", "field": "creation_timestamp", "uuid": "3c3447a8-5b12-4f3d-8b96-10a3f87df1eb", "content": "Ultra Addons for Contact Form 7 \u22643.5.50 has a CRITICAL file upload vulnerability (CVSS 9.8). RCE possible if PDF Generator is enabled. Disable the module & monitor for updates. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mwhiltdqgj2m"}, {"timestamp": "2026-09-27T03:00:13Z", "date_only": false, "value": "2026-09-27T03:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/p3dYGgWnG8fmLkkUzShxHg-2DTS1_J4yi6svLDGp4dVNyII", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "6bf03976-cc88-4c24-bc60-1675fe690a63"}, {"timestamp": "2026-09-27T03:00:13Z", "date_only": false, "value": "2026-09-27T03:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/p3dYGgWnG8fmLkkUzShxHg-2DTS1_J4yi6svLDGp4dVNyII", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "282be595-8e73-450d-88f3-ef6238cd6744"}, {"timestamp": "2026-09-27T09:00:04Z", "date_only": false, "value": "2026-09-27T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/bthUwEydglWykkPvRI1AZQI-_R5qiWbBEj7i9q47DZSvdxk", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "ddbd1a75-7b29-4c99-b512-876c4d30bd50"}, {"timestamp": "2026-09-27T09:00:04Z", "date_only": false, "value": "2026-09-27T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/bthUwEydglWykkPvRI1AZQI-_R5qiWbBEj7i9q47DZSvdxk", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "36efdd33-f3ab-41ab-9b72-b658a6cef123"}, {"timestamp": "2026-09-27T13:22:45.487Z", "date_only": false, "value": "2026-09-27T13:22:45.487301Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwivg6bjay2v", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "4080b1d9-1da2-4640-b4ed-97c5dc4c00e5", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-82901: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the \u2026\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-82901\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mwivg6bjay2v"}, {"timestamp": "2026-09-28T15:16:04.793Z", "date_only": false, "value": "2026-09-28T15:16:04.793", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82901", "record": "FKIE_CVE-2026-82901", "field": "lastModified"}, {"timestamp": "2026-09-29T11:00:19Z", "date_only": false, "value": "2026-09-29T11:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/1RQeb1HjNkrQgeLVuhp8BTCYScKY_LLqUTOdK2mni14dXJ8", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "4c006d15-ba2c-4cd4-9e2d-9a20f11f5d33"}, {"timestamp": "2026-09-29T11:00:19Z", "date_only": false, "value": "2026-09-29T11:00:19.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1RQeb1HjNkrQgeLVuhp8BTCYScKY_LLqUTOdK2mni14dXJ8", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "2b9c79f2-73a4-42bf-b707-c1a84a75cf4d"}, {"timestamp": "2026-09-29T21:00:04Z", "date_only": false, "value": "2026-09-29T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/lM6IiPde2gp6yF9c7PeyyUE557eYgP1ySYX_5N_0Ol2vx7Y", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "9df560c7-3349-4c5a-99c6-7d4a2bf49f7e"}, {"timestamp": "2026-09-29T21:00:04Z", "date_only": false, "value": "2026-09-29T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/lM6IiPde2gp6yF9c7PeyyUE557eYgP1ySYX_5N_0Ol2vx7Y", "record": "CVE-2026-82901", "field": "creation_timestamp", "uuid": "cffe9ce3-6ef5-43d1-ac40-acfa080481a6"}]}