Ultimate Addons for Contact Form 7, CVE-2025-14356

CVE, Research URL: CVE-2025-14356
Home page URL: Security reports for Ultimate Addons for Contact Form 7
Application: Ultimate Addons for Contact Form 7
Published on: Dec 12, 2025
Research Description: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate and get form submission PDF, when the "PDF Generator" and the "Database" addons are enabled (disabled by default).
Affected versions: max 3.5.34.
Status: vulnerable