cleantalk
Vulnerabilities and Security Researches

Ultimate Addons for Contact Form 7, CVE-2025-14356

CVE, Research URL

CVE-2025-14356

Home page URL

Security reports for Ultimate Addons for Contact Form 7

Application

Ultimate Addons for Contact Form 7

Published on
Dec 12, 2025
Research Description
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate and get form submission PDF, when the "PDF Generator" and the "Database" addons are enabled (disabled by default).
Affected versions
max 3.5.34.
Status
vulnerable
Previous vulnerability researches
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2015-5532) , Jun 06, 2024
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2021-25114) , Jun 06, 2024
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2020-5579) , Jun 06, 2024
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2021-24979) , Jun 06, 2024
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (CVE-2021-20678) , Jun 06, 2024
New vulnerability
Ultimate Addons for Contact Form 7 (CVE-2025-14356) , Dec 22, 2025
GitHub Gist Shortcode Plugin (CVE-2025-12667) , Dec 12, 2025
Cryptocurrency Payment Gateway for WooCommerce (CVE-2025-12392) , Dec 12, 2025
Wbcom Designs – Private Community for BuddyPress (CVE-2025-67582) , Dec 12, 2025
WP-Walla (CVE-2025-12589) , Dec 12, 2025