WordPress - Ultra Addons For Contact Form 7 - CRITICAL - CVE-2026-82901. The Ultra Addons for Contact Form 7 plugin for WordPress contains a vulnerability that allows unauthorized file uploads due to inadequate validation of file types in the 'uacf7_wpcf7_mail_components' function. This weakness affects all versions up to and including 3.5.50. When exploited, particularly with the PDF Generator module enabled (although disabled by default), attackers could potentially upload arbitrary files, which may lead to remote code execution on the server hosting the affected site.