A critical (CVSS 9.8) vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin lets unauthenticated attackers delete arbitrary files on the server when the plugin's PDF generator feature is enabled. Deleting the right file can lead to remote code execution.
What Is It
CVE-2026-102435 is a vulnerability in the Ultra Addons for Contact Form 7 plugin for WordPress, developed by themefic. Wordfence assigned the CVE and classifies it as CWE-502 (Deserialization of Untrusted Data). The root cause is untrusted input reaching deserialization in the plugin's _getObjAttr function. That lets an attacker inject a PHP object, and the resulting arbitrary file deletion is the impact of the injection. The deletion runs through a WPCF7_Submission POP gadget chain, which depends on Contact Form 7 being present and triggers the file deletion through __destruct().
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means the flaw can be exploited over the network with low complexity, and the attacker needs no privileges and no user interaction. According to the NVD description, deleting the right file (for example, wp-config.php) "can easily lead to remote code execution."
At the time of writing, this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so CISA has not confirmed active exploitation. NVD lists the record as "Deferred."
What's Vulnerable
- Product: Ultra Addons for Contact Form 7 (themefic)
- Affected versions: All versions up to and including 3.5.54
The NVD description says the vulnerability can only be exploited when the PDF generator feature is enabled. In practice, exploitation probably also needs a Contact Form 7 form that is set up to use PDF generation, but the cited advisories do not state this as a separate requirement. Sites that meet these conditions are most clearly exposed. Administrators should not assume a site is safe just because one of these conditions looks unmet.
Patch Status
The supplied data does not name a fixed version or give vendor remediation guidance. The CVE is not in the CISA KEV catalog, so there is no CISA required action. A WordPress plugin changeset (3738548) is listed among the references and may contain the related code change.
Administrators running version 3.5.54 or earlier should: - Check the plugin's WordPress.org listing and the Wordfence advisory for an updated release - Consider disabling the PDF Generator add-on until a fixed version is confirmed, since NVD states that exploitation requires that feature to be enabled