UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-100386

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

Severity
High 7.5
Published
10 Nov 2026
Last changed
10 Nov 2026
Added to UpHeron
10 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Ultimate Addons For Contact Form 7 (WordPress plugin)WordPress plugins · wp-plugin:ultimate-addons-for-contact-form-7
  • Every version up to 3.5.54

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-100386