{"id":"CVE-2026-102435","published":"2026-11-02T20:17:26.287","lastModified":"2026-11-02T20:17:26.440","description":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Ultra Addons for Contact Form 7 WordPress plugin (≤3.5.54) contains a path traversal flaw in its _getObjAttr function that allows unauthenticated attackers to delete arbitrary files on the server when the PDF Generator add-on is active, potentially leading to remote code execution by deleting critical files like wp-config.php.","exploitability":"Exploitation requires the PDF Generator add-on to be enabled and a Contact Form 7 form configured for PDF generation; no authentication is needed, but successful exploitation depends on the target server having the vulnerable plugin configuration.","blast_radius":"Successful exploitation could lead to full system compromise via deletion of core WordPress files, enabling remote code execution and potential data exfiltration or site takeover.","remediation":"Upgrade to Ultra Addons for Contact Form 7 version 3.5.55 or later; if upgrading is not immediately possible, disable the PDF Generator add-on until a patch is applied.","detection":"Look for HTTP POST requests to WordPress endpoints (e.g., /wp-admin/admin-ajax.php) containing unusual parameters that trigger file path resolution in the Ultra Addons plugin, followed by server-side file deletion events logged in WordPress debug.log or filesystem audit logs; specifically monitor for attempts to delete files outside the expected uploads directory.","tags":["rce","file-deletion","wordpress","plugin-vulnerability","path-traversal"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:55:02.182Z"}}