CVE-2026-102435

The record

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.

Affected packages

Related vulnerabilities

• CVE-2026-115878 Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and… CWE-502
• CVE-2026-115731 Deserialization of untrusted data in the report-processing code of Puppet, as used by… CWE-502
• CVE-2026-120833 labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in… CWE-502
• CVE-2026-120320 A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. CWE-502
• CVE-2026-118636 **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls… CWE-502
• CVE-2026-109220 The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is… CWE-502
• CVE-2026-63393 OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. CWE-502
• CVE-2026-118938 In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted… CWE-502