[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":67,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":74,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":80,"vulnerability-29893":87},[4,29,36,44,53,59],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - top pages, pricing CTA","php2shell-rce","🚨 Detect PHP2Shell with any paid plan. Get proof now","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams","See pricing options","secondary",{"title":30,"slug":31,"text":32,"link":8,"external":9,"targets":33,"cta":35,"variant":28,"campaign_id":6},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[34],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":37,"slug":38,"text":39,"link":40,"external":41,"targets":42,"cta":40,"variant":28,"campaign_id":6},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[43],"\u002Fpricing",{"title":45,"slug":46,"text":47,"link":48,"external":9,"targets":49,"cta":52,"variant":28,"campaign_id":46},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",[50,51],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":54,"slug":55,"text":56,"link":8,"external":9,"targets":57,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan",[58],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan",{"title":60,"slug":61,"text":62,"link":8,"external":9,"targets":63,"cta":27,"variant":28,"campaign_id":61},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[64,65,66],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",["Island",68],{"key":69,"params":70,"result":72},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":71},"{}",{"head":73},{},["Island",75],{"key":76,"params":77,"result":78},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":71},{"head":79},{},["Island",81],{"key":82,"params":83,"result":85},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":84},"{\"text-color\":\"gray\"}",{"head":86},{},{"id":88,"detectable_with":89,"vuln_details":96,"vuln_id":113,"name":114,"published":115,"updated":40},29893,{"tool":90,"engine":93},{"id":91,"name":92},1,"Network Scanner",{"id":94,"name":95},2,"Nuclei",{"id":88,"codename":40,"description":40,"severity":97,"risk_description":98,"public_description":99,"public_recommendation":100,"recommendation":40,"references":101,"cvssv3":105,"epss_score":106,"epss_percentile":107,"cve":108,"in_cisa_catalog":41,"date":110,"software_type":40,"vendor":111,"product":112,"ptt_exploit_capabilities":40},"high","Unauthenticated arbitrary file write into a web-accessible directory under the site origin. This enables planting attacker-controlled content (HTML\u002FSVG leading to stored XSS, phishing pages, .htaccess where AllowOverride permits). Where the web server maps a surviving executable extension (e.g. .pht, .phar, .phtml) to the PHP handler, it escalates to remote code execution; note that Contact Form 7 core runs wpcf7_antiscript_file_name() first and rewrites php\u002Fphtml\u002Fpl\u002Fpy\u002Frb\u002Fcgi\u002Fasp\u002Faspx uploads to a harmless *.\u003Cext>_.txt, so a plain .php name does not execute on a default install.","Ultimate Addons for Contact Form 7 (UACF7) \u003C= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content\u002Fuploads\u002Fuacf7-uploads\u002F with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons\u002Fpdf-generator\u002Fpdf-generator.php, which stores the file as \"{time()}-{field_name}-{sanitize_file_name(basename)}\". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME\u002Fextension allowlist.","Update Ultimate Addons for Contact Form 7 to 3.5.51 or later. As mitigation, disable the PDF Generator module and deny script execution and direct access in wp-content\u002Fuploads\u002F.",[102,103,104],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fultimate-addons-for-contact-form-7\u002Fvulnerability\u002Fwordpress-ultra-addons-for-contact-form-7-plugin-3-2-4-3-5-50-unauthenticated-arbitrary-file-upload-vulnerability","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-addons-for-contact-form-7\u002Ftags\u002F3.5.48\u002Faddons\u002Fpdf-generator\u002Fpdf-generator.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82901",8.1,0.04328,0.91116,[109],"CVE-2026-82901","2026-09-26T00:00:00Z","themefic","ultimate-addons-for-contact-form-7","NETSCAN-NUCLEI-CVE-CVE-2026-82901","Ultimate Addons for Contact Form 7 \u003C= 3.5.50 - Arbitrary File Upload","2026-10-24T00:00:00Z"]