TI-2026-83954 Aliases CVE-2026-102435 GHSA-68fh-vvhf-6vfx

Arbitrary file deletion in Ultra Addons for Contact Form 7

MEDIUM 50CWE-502Published 2026-11-02 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Ultra Addons for Contact Form 7 for WordPress is affected in all versions up to and including 3.5.54. Insufficient file path validation in the _getObjAttr function lets unauthenticated remote attackers delete arbitrary server files, which can lead to remote code execution by deleting wp-config.php. Untrusted data is deserialized (CWE-502), and exploitation requires the PDF Generator add-on to be active with a form configured for PDF generation.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0059 48th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Themefic	Ultra Addons for Contact Form 7	up to 3.5.54	—	No fix listed	CNA

Ultra Addons for Contact Form 7 VendorThemefic Affected up to 3.5.54 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:themefic:ultimate_addons_for_contact_form_7::::::::	—	—	Themefic

cpe:2.3:a:themefic:ultimate_addons_for_contact_form_7:*:*:*:*:*:*:*:* Versions — — ·Themefic

Remediation

The sources list no fixed version for Ultra Addons for Contact Form 7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

2026-11-02 Threatist record created from CVE-2026-102435
2026-11-02 Alias added: GHSA-68fh-vvhf-6vfx
2026-11-03 CISA SSVC decision points changed

References

Other 3

TI-2023-02626 Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS CVSS 3.1MEDIUM 6.1
TI-2026-57195 Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field CVSS 3.1CRITICAL 9.8
TI-2023-02625 Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
TI-2024-19308 WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
TI-2022-23624 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
TI-2025-30046 WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload Vulnerability CVSS 3.1CRITICAL 9.1

See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences