CVE-2026-102435 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-102435 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-102435 is a critical vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin, rated CVSS 9.8. It allows unauthenticated arbitrary file deletion through insufficient file path validation in the _getObjAttr function, affecting all versions up to and including 3.5.54. In the worst case, deleting a file like wp-config.php can lead to remote code execution and full site compromise.

Important: exploitation requires the PDF Generator add-on to be active and a Contact Form 7 form configured for PDF generation. This is not currently known to be exploited in the wild and is not in CISA KEV, but the impact is severe enough that solo developers and small teams should treat it as an emergency.

Immediate Action

  • Disable the PDF Generator feature now if you do not need it. This is the fastest way to reduce exposure while you patch.
  • Upgrade Ultra Addons for Contact Form 7 to a fixed release as soon as the vendor publishes one. If no fixed version is available yet, remove the plugin or roll back to a known-safe alternative.
  • Temporarily isolate the site behind maintenance mode, IP allowlisting, or a WAF rule if you cannot patch immediately.
  • Back up the full site and database before making changes, then verify the backup can be restored.
  • Check for tampering around wp-config.php, uploads, and recent file deletions after mitigation.
  • Monitor vendor updates and advisory details: Vendor advisory / patch notes

Affected Versions

  • ultra-addons-for-contact-form-7@<=3.5.54 — vulnerable
  • ultra-addons-for-contact-form-7@TODO_FIXED_VERSION+ — safe once vendor confirms the patched release
  • Condition required: PDF Generator add-on must be active, and a CF7 form must be configured for PDF generation

Resolution Guide

WordPress / plugin update: Use your admin dashboard, WP-CLI, or deployment pipeline to update immediately once a fixed version is available.

# WordPress CLI: check installed version
wp plugin list --field=name --status=active | grep -i "ultra"

# Update the plugin when a fixed version is available
wp plugin update ultra-addons-for-contact-form-7

# If no patch exists yet, deactivate the plugin
wp plugin deactivate ultra-addons-for-contact-form-7

Config hardening: disable the vulnerable PDF generation path until patched.

# Example: disable the PDF generator add-on in the WordPress admin
# or via deployment config if your site uses feature flags

define('UACF7_DISABLE_PDF_GENERATOR', true); // TODO: replace with vendor-supported flag if available

Docker / containerized WordPress: rebuild with the patched plugin or remove it from the image.

# Rebuild after removing the vulnerable plugin from the image
docker build -t my-wordpress:patched .

# Run the updated image
docker run -d --name wordpress -p 80:80 my-wordpress:patched

Linux package managers: this issue is plugin-specific, so apt/yum will not usually apply directly. Use them only if your deployment bundles WordPress via OS packages.

# Debian/Ubuntu hosts: update the web stack, then redeploy the patched plugin
sudo apt update
sudo apt upgrade -y

# RHEL/CentOS/Fedora hosts
sudo yum update -y
# or
sudo dnf update -y

JavaScript / Python / Java ecosystems: not directly applicable to this WordPress plugin, but if your team mirrors the plugin in a build pipeline or scans dependencies, keep your dependency lockfiles current.

# npm/yarn/pnpm examples for general dependency hygiene
npm audit
yarn audit
pnpm audit

# Python
pip list --outdated
pip-audit

# Java
mvn -q versions:display-dependency-updates
./gradlew dependencyUpdates

Minimal code fix pattern: if you maintain a fork or custom integration, validate file paths before deletion and reject traversal.

// Pseudocode patch pattern
$base = realpath($allowed_dir);
$target = realpath($candidate_path);

if ($base === false || $target === false || strpos($target, $base . DIRECTORY_SEPARATOR) !== 0) {
    throw new Exception('Invalid file path');
}

if (is_file($target)) {
    unlink($target);
}

Detection & Verification

Check the installed version:

wp plugin list --name=ultra-addons-for-contact-form-7 --fields=name,status,version

Search for PDF Generator usage:

# Look for plugin settings or form configs tied to PDF generation
grep -Rni "pdf" wp-content/plugins/ultra-addons-for-contact-form-7/
grep -Rni "Contact Form 7" wp-content/uploads/ wp-content/plugins/ | head

Verify the fix:

# Confirm the vulnerable version is gone
wp plugin list --field=name --status=active | grep -i "ultra"

# Confirm the plugin files match the patched release after update
sha256sum wp-content/plugins/ultra-addons-for-contact-form-7/*

Additional checks: review web server logs for suspicious requests to plugin endpoints, unexpected file deletions, and recent changes to wp-config.php, .htaccess, and upload directories. If you use a file integrity monitor, compare current hashes against a known-good baseline.

Risk and Impact

This flaw can let an unauthenticated attacker delete arbitrary files on the server. If the attacker removes a sensitive file such as wp-config.php, the site may be forced into a reconfiguration state or become vulnerable to code execution through follow-on abuse. For small teams, the blast radius can include full site takeover, data exposure, defacement, and downtime across the entire WordPress instance and any apps sharing the same host.

Because exploitation depends on the PDF Generator add-on being active, some sites may not be exposed. But if that feature is enabled, the risk is immediate and high: patch or disable the feature now.

Keep reading