Research Plan: Ultra Addons for Contact Form 7 Stored XSS (CVE-2026-32460)

1. Vulnerability Summary

The Ultra Addons for Contact Form 7 plugin (up to 3.5.36) contains a stored cross-site scripting (XSS) vulnerability in its option import functionality. The vulnerability exists because the AJAX handler uacf7_option_import_callback fails to properly validate the user's capabilities (due to an incorrect use of is_admin()) and subsequently stores unsanitized JSON data into post meta. This data is then rendered on the frontend or backend without sufficient escaping.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: uacf7_option_import (hooked via wp_ajax_uacf7_option_import)
• Vulnerable Parameter: tf_import_option (JSON string)
• Required Authentication: Contributor or higher.
• Privilege Escalation Mechanism: The plugin attempts to restrict the action to administrators but uses the following check:

  if ( $current_user_role !== 'administrator' && ! is_admin() ) {
      wp_die( 'You do not have sufficient permissions to access this page.' );
  }
  

  In the context of an AJAX request (admin-ajax.php), is_admin() always returns true. Therefore, the condition $current_user_role !== 'administrator' && false always evaluates to false, allowing any authenticated user with access to the admin dashboard (like a Contributor) to bypass the check.

3. Code Flow

1. Entry Point: UACF7_Options::__construct() registers the AJAX action:
   add_action( 'wp_ajax_uacf7_option_import', array( $this, 'uacf7_option_import_callback' ) );
2. Nonce Verification: uacf7_option_import_callback() verifies the nonce tf_options_nonce.
3. Authorization Bypass: The function performs the flawed role check described above.
4. Data Processing:
   • $imported_data is created by json_decode( wp_unslash( trim( $_POST['tf_import_option'] ) ), true );.
   • $form_id is retrieved from $_POST['form_id'].
5. Sink: The unsanitized array is saved to the database:
   update_post_meta( $form_id, 'uacf7_form_opt', $imported_data );
6. Rendering: When the contact form (ID: $form_id) is rendered, the plugin retrieves uacf7_form_opt and outputs values (likely in a style block or wrapper div) without proper escaping.

4. Nonce Acquisition Strategy

The nonce tf_options_nonce is localized into the JavaScript variable tf_options_params. This occurs in admin/tf-options/TF_Options.php within the tf_options_admin_enqueue_scripts method.

Strategy:

1. Log in as a Contributor.
2. The script is enqueued on several admin screens, including the Contact Form 7 list page (toplevel_page_wpcf7).
3. Navigate to /wp-admin/admin.php?page=wpcf7.
4. Execute browser_eval to extract the nonce:
   browser_eval("window.tf_options_params?.tf_options_nonce")

5. Exploitation Strategy

1. Preparation: Identify an existing Contact Form 7 form ID (e.g., 123). If none exist, create one.
2. Payload Crafting: Create a JSON object where values contain XSS payloads. Since this meta is for "Form Options" (styling), common fields likely include font families or custom CSS.
   • payload = {"uacf7_custom_css": "</style><script>alert(document.domain)</script>"}
3. Request: Send a POST request to admin-ajax.php.
   • Action: uacf7_option_import
   • ajax_nonce: [Extracted Nonce]
   • form_id: 123
   • tf_import_option: {"any_key": "<img src=x onerror=alert(1)>"}
4. Verification: View the page where Contact Form 123 is embedded.

6. Test Data Setup

1. Install Plugins: Contact Form 7 and Ultra Addons for Contact Form 7 (v3.5.36).
2. Create User: A user with the contributor role.
3. Create Form: A Contact Form 7 form. Note its ID (e.g., wp-post-create or check the UI).
4. Create Page: A public page containing the shortcode: [contact-form-7 id="123" title="Test Form"].

7. Expected Results

• The AJAX request should return a JSON success message: {"success":true,"data":{"status":"success","message":"Options imported successfully!"}}.
• The database should show the payload stored in the wp_postmeta table for the specified post_id under the key uacf7_form_opt.
• When visiting the public page, an alert box should trigger.

8. Verification Steps (WP-CLI)

Check if the meta was successfully injected:

wp post meta get [FORM_ID] uacf7_form_opt --format=json

This should return the JSON object containing the <script> or <img> tag.

9. Alternative Approaches

If the tf_options_nonce is not localized on the main Contact Form 7 page for Contributors, try navigating to:

• /wp-admin/admin.php?page=uacf7_settings
• /wp-admin/admin.php?page=uacf7_setup-wizard

If a specific key is required in the JSON for it to be rendered, analyze admin/tf-options/metaboxes/ or options/ files to find valid option keys used by the plugin (e.g., form-title-color, form-background-color). A reliable fallback is to inject into every key:
{"key1": "<script>alert(1)</script>", "key2": "<script>alert(1)</script>" ...}