CVE-2025-6220

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
themeficUltra Addons for Contact Form 7<= 3.5.12

References

Timeline

Published
Jun 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-622007.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622017.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622027.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-622037.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622048.0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-622057.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-622066.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to discloCVE-2025-622079.8Azure Monitor Elevation of Privilege VulnerabilityCVE-2025-622085.5Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.CVE-2025-622095.5Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.CVE-2025-62216.4The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and incluCVE-2025-622108.7Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an author
CVE-2025-6220: High severity, CVSS 7.2 | Vulnix