CVE-2026-102435

Summary

The Ultra Addons for Contact Form 7 WordPress plugin (≤3.5.54) contains a path traversal flaw in its _getObjAttr function that allows unauthenticated attackers to delete arbitrary files on the server when the PDF Generator add-on is active, potentially leading to remote code execution by deleting critical files like wp-config.php.

Exploitability

Exploitation requires the PDF Generator add-on to be enabled and a Contact Form 7 form configured for PDF generation; no authentication is needed, but successful exploitation depends on the target server having the vulnerable plugin configuration.

Blast radius

Successful exploitation could lead to full system compromise via deletion of core WordPress files, enabling remote code execution and potential data exfiltration or site takeover.

Detection

Look for HTTP POST requests to WordPress endpoints (e.g., /wp-admin/admin-ajax.php) containing unusual parameters that trigger file path resolution in the Ultra Addons plugin, followed by server-side file deletion events logged in WordPress debug.log or filesystem audit logs; specifically monitor for attempts to delete files outside the expected uploads directory.

Prioritized remediation

Upgrade to Ultra Addons for Contact Form 7 version 3.5.55 or later; if upgrading is not immediately possible, disable the PDF Generator add-on until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.