Arbitrary File Deletion Vulnerability in Ultra Addons for Contact Form 7 Plugin by WordPress

CVE-2026-102435

What is CVE-2026-102435?

The Ultra Addons for Contact Form 7 plugin for WordPress has a vulnerability that enables unauthenticated attackers to delete arbitrary files from the server due to inadequate file path validation in the _getObjAttr function. This flaw affects all versions up to and including 3.5.54, particularly when the PDF Generator add-on is active. If exploited, this can lead to severe consequences, including remote code execution if critical files such as wp-config.php are removed. Successful exploitation requires the configuration of a Contact Form 7 form for PDF generation, allowing the misuse of the WPCF7_Submission POP gadget chain to facilitate unauthorized file deletions.

References