CVE-2026-100386

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the PDF Generator addon to be active and an administrator-configured PDF body template to be enabled for the targeted contact form.

• CWE-22

• https://downloads.wordpress.org/plugin/ultimate-addons-for-contact-form-7.zip
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.50/addons/pdf-generator/pdf-generator.php#L625
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.50/addons/pdf-generator/pdf-generator.php#L782
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.50/addons/pdf-generator/pdf-generator.php#L950
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.50/addons/pdf-generator/pdf-generator.php#L963
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php#L625
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php#L782
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php#L950
• https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php#L963
• https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7/trunk/addons/pdf-generator/pdf-generator.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a52d6222-688f-4300-b53d-db2cc31f924a?source=cve

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100379Exposure of Sensitive Information to an Unauthorized Actor v…5.3
• CVE-2026-10038The Charitable – Donation Plugin for WordPress – Fundraising…4.3
• CVE-2026-100380Improper Neutralization of Input During Web Page Generation …5.3
• CVE-2026-100381Improper Neutralization of Input During Web Page Generation …5.3
• CVE-2026-100382Improper Neutralization of Special Elements used in an OS Co…10
• CVE-2026-100383Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2026-100387pgPointcloud through 1.2.5 contains a heap out-of-bounds rea…8.1
• CVE-2026-100388RustDesk versions before 1.5.0 fail to properly validate fil…5.4
• CVE-2026-100389GestSup versions before 3.2.62 contain a remote code executi…8.1
• CVE-2026-10039The Frontend Admin by DynamiApps plugin for WordPress is vul…4.9
• CVE-2026-100390Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse I…7.4
• CVE-2026-100391MediaFlow Proxy through 2.4.9 contains a server-side request…8.2