CVE-2026-102435— Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

Quick assessment

Affected

themefic Ultra Addons for Contact Form 7

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Ultra Addons for Contact Form 7"存在任意文件删除漏洞，原因是其函数中对文件路径的验证不足。该漏洞影响所有 3.5.54 及更早版本。未认证的攻击者可利用此漏洞删除服务器上的任意文件；若删除了关键文件（例如），则极易导致远程代码执行（RCE）。触发此漏洞需同时满足以下条件： PDF Generator 附加组件已启用；已配置用于 PDF 生成的 Contact Form 7 表单。这是因为漏洞利用依赖于的 POP（对象属性利用）链，该链需要 Con

CVSS 9.8 · Critical Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1070 · Indicator Removal T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
themefic	Ultra Addons for Contact Form 7	`≤ 3.5.54`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

Source: CVE Program / CVE List V5

Vulnerability Description

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
themefic	Ultra Addons for Contact Form 7	0 ~ 3.5.54	-

II. Public POCs for CVE-2026-102435

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102435

请登录查看更多情报信息。

Other References for CVE-2026-102435 (3)

https://www.cve.org/CVERecord?id=CVE-2026-102435

IV. Related Vulnerabilities

Same product: Ultra Addons for Contact Form 7

Same vendor: themefic

Same weakness: CWE-502