{"vulnerability": "CVE-2026-82901", "sightings": [{"uuid": "af1e4004-e386-4263-bce8-f942ad879b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwh3lwtfdr2y", "content": "\ud83d\udea8 CVE-2026-82901 \u2014 CVSS 9.8 CRITICAL\n\nThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-82901\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-26T20:08:01.900005Z"}, {"uuid": "1fa3f49f-0438-4028-8bb8-c5c482e1d067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d6e4y6mor2wjq", "content": "CVE-2026-82901 - Ultra Addons for Contact Form 7\nCVE ID : CVE-2026-82901\n \n Published : Sept. 26, 2026, 7:16 p.m. | 1\u00a0hour, 2\u00a0minutes ago\n \n Description : The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file t...", "creation_timestamp": "2026-09-26T20:42:06.935187Z"}, {"uuid": "db6dde66-c2e6-4a98-b690-2efeca82015c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwh6qpmljg2t", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cUltra Addons for Contact Form 7\u300d\u3067\u3001PDF\u751f\u6210\u30e2\u30b8\u30e5\u30fc\u30eb\u6709\u52b9\u6642\u306b\u4e0d\u5341\u5206\u306a\u30d5\u30a1\u30a4\u30eb\u7a2e\u5225\u691c\u8a3c\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u53ef\u2026\nCVE-2026-82901 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-09-26T21:04:23.722751Z"}, {"uuid": "4256c7c0-6ed3-4dbd-9762-e51bd1b2581c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwhdjzmyib26", "content": "CVE-2026-82901 - ultra addons for contact form 7\nThe Ultra Addons for Contact Form 7 plugin for WordPress can let anyone upload files to your server when its PDF Generator feature is turned on. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#themefic #CVE #infosec", "creation_timestamp": "2026-09-26T22:30:07.380466Z"}, {"uuid": "676fcdc5-6b1a-411f-ae14-fd9ebbe8f3df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwhhtmuimw2c", "content": "\ud83d\udd34 CVE-2026-82901 - Critical (9.8)\n\nThe Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload d...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82901/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T23:47:05.876682Z"}, {"uuid": "72130f1c-e3a7-4fc1-9401-cf12f0f49b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://t.me/GithubRedTeam/103477", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-82901\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 21:12:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 \u22643.5.50 unauth file upload via signature field when PDF Generator is enabled \u2192 wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T22:00:08.000000Z"}, {"uuid": "78f17c39-4ebf-4d65-85d3-e340f5b8b75e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-82901", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117340060673817158", "content": "CVE-2026-82901: CRITICAL (CVSS 9.8) file upload vuln in Ultra Addons for Contact Form 7 (\u22643.5.50). RCE risk if PDF Generator enabled (off by default). Disable/monitor plugin & watch for patches. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra-addons-for-77a59cd90a3fbad1 #OffSeq #WordPress #Infosec #Vulnerability", "creation_timestamp": "2026-09-27T00:00:35.354307Z"}, {"uuid": "3c3447a8-5b12-4f3d-8b96-10a3f87df1eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-82901", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwhiltdqgj2m", "content": "Ultra Addons for Contact Form 7 \u22643.5.50 has a CRITICAL file upload vulnerability (CVSS 9.8). RCE possible if PDF Generator is enabled. Disable the module & monitor for updates. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra...", "creation_timestamp": "2026-09-27T00:00:37.509728Z"}, {"uuid": "af1e4ee9-4ec7-4d89-9b84-1314b98a907b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103477", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-82901\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 21:12:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 \u22643.5.50 unauth file upload via signature field when PDF Generator is enabled \u2192 wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-26T22:00:08.000000Z"}, {"uuid": "4080b1d9-1da2-4640-b4ed-97c5dc4c00e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82901", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwivg6bjay2v", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-82901: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the \u2026\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-82901\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-27T13:22:45.487301Z"}]}