WordPress: Arbitrary File Upload in Ultra Addons for Contact Form 7 Plugin

In the Ultra Addons for Contact Form 7 plugin for WordPress versions up to and including 3.5.12 a high severity vulnerability CVE-2025-6220 was detected. This vulnerability allows authenticated attackers with Administrator-level access and above to upload arbitrary files to the affected site’s server due to missing file type validation in the save_options function, potentially leading to remote code execution. To address this issue, users should upgrade the Ultra Addons for Contact Form 7 plugin to versions 3.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6220.