On this page (7 sections)
A critical vulnerability, CVE-2026-102435, has been published for the Ultra Addons for Contact Form 7 plugin for WordPress. According to the GitHub Advisory Database entry, unauthenticated attackers can delete arbitrary files on the server in all versions up to and including 3.5.54, which can lead to remote code execution if the right file is removed.
If you run WordPress sites that use this plugin, especially with its PDF Generator feature, check your exposure today. The advisory does not list a fixed version, so this article focuses on how to verify your setup and reduce risk while the patch status is confirmed.
What happened
The CVE was published on November 2, 2026, and the same description appears in the GitHub Advisory Database and the NVD record. The description says insufficient file path validation in the _getObjAttr function allows arbitrary file deletion by unauthenticated attackers.
All technical details come from that single description. The NVD text repeats it, so it is not independent confirmation. The GitHub entry is marked unreviewed. It also lists a Wordfence threat intelligence entry and a WordPress plugin changeset as references; we did not review the contents of either, so we cannot say what they add.
The GitHub entry lists no package, affected range or patched version in its structured fields, so automated tools such as Dependabot cannot flag it. Do not rely on automated alerts alone for this one.
Why file deletion can mean full takeover
The weakness class is deserialization of untrusted data. In plain terms, the plugin turns data supplied by a visitor back into a PHP object without checking it carefully enough. According to the advisory, a chain of existing classes (a so-called POP gadget chain) that relies on Contact Form 7 being present ends up deleting a file when the object is destroyed via __destruct().
Deleting a file sounds less severe than uploading one, but the advisory states it can easily lead to remote code execution when the right file is deleted, such as wp-config.php. The advisory does not explain the mechanism further, and this article does not describe exploitation steps.
Who is realistically exposed
The advisory sets two conditions. The PDF Generator add-on must be active, and a Contact Form 7 form must be configured for PDF generation. It also states the vulnerability can only be exploited when the PDF generator feature is enabled.
- Exposed: sites running Ultra Addons for Contact Form 7 version 3.5.54 or earlier with PDF generation turned on for at least one form.
- Likely lower risk: sites with the plugin installed but the PDF Generator feature disabled. The advisory says exploitation requires it, but treat this as a mitigation, not a reason to ignore the plugin.
- Not affected by this CVE: sites that do not have the plugin installed. Contact Form 7 itself is not named as vulnerable.
How to check your exposure
Start by finding out whether the plugin is installed and which version runs. This WP-CLI command lists all installed plugins with their status and version, with no filtering so nothing is missed. Run it from the WordPress root on each site and look for a line named ultimate-addons-for-contact-form-7; a version of 3.5.54 or lower is in the affected range.
wp plugin list --fields=name,status,versionAlso review the Plugins page in the WordPress admin and look for Ultra Addons for Contact Form 7. Then open your Contact Form 7 forms and check whether any of them is configured to generate a PDF.
Next, confirm that your site's critical files are present. This read-only command lists wp-config.php in the current directory. Run it from the WordPress root; an error saying the file does not exist means it is missing and the site needs urgent attention.
ls -l wp-config.phpWhat to do now
The research does not name a fixed release. Check the official WordPress.org plugin page for the current version and its changelog, and reduce exposure until you have confirmed that a version newer than 3.5.54 addresses this CVE.
0 of 8 done
The advisory also references a Wordfence entry and a plugin changeset. We have not reviewed their contents, so do not assume either confirms a fix. Our known vulnerabilities per plugin page and the guide on checking whether a plugin is vulnerable can help with a wider review.
Detection and monitoring
Since the advisory describes file deletion, missing or changed files are the most useful signal. The research does not say which request path is involved, so the command below is generic anomaly hunting and not specific to this CVE. It counts POST requests per client IP in an nginx access log so you can spot unusual bursts. Adjust the log path to your server; it does not prove exploitation.
grep '"POST ' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head- Watch for sudden 500 errors or a site that stops loading normally, which can mean a core file such as wp-config.php is gone.
- Alert on file integrity changes in the WordPress root and the plugin directory.
- Look for new administrator accounts, unfamiliar PHP files in uploads, and unexpected scheduled tasks if the site was reachable while vulnerable.
- Keep uptime and certificate monitoring on, so an outage after file loss is noticed quickly. Webforta Monitor covers uptime, certificate and DNS changes.
If you suspect a compromise, follow the steps in Website hacked: what to do, and run a free malware scan as one data point. Outside-in scanning has limits, as explained in what outside-in malware detection can and cannot see.
What is still unknown
- The first patched version is not stated in the advisory or NVD text.
- No source in the research reports active exploitation, and the CVE has no CISA KEV entry. Absence of reports is not proof that attacks are not happening.
- All technical claims rest on one description (GitHub advisory, repeated by NVD), and the GitHub entry is marked unreviewed. Wordfence and the changeset are listed as references but were not independently reviewed.
Treat the details as provisional until a vendor release note or reviewed advisory confirms the fixed version. In the meantime, the conditions are narrow enough that disabling PDF generation is a reasonable stopgap for most sites.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.