Ultimate Addons for Contact Form 7 Arbitrary File Upload Vulnerability

A vulnerability exists in the Ultimate Addons for Contact Form 7 WordPress plugin, in versions through 3.5.12, allowing authenticated users with Administrator-level access to upload arbitrary files. This issue arises from inadequate file type validation in the 'save_options' function, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the possibility of executing uploaded files as code, depending on the file type and execution context.

Reproduction

To reproduce this vulnerability, log into the WordPress admin panel and navigate to 'Ultimate Addons -> Settings'. Intercept the 'save_options' POST request using a tool like Burp Suite. Append the file data, including a web shell named 'shell.php', into the request. After forwarding the modified request, the response will indicate a successful upload. The uploaded web shell can then be accessed and executed.

Remediation

Users are advised to update the Ultimate Addons for Contact Form 7 plugin to version 3.5.13 or later.