CVE-2026-102435: Arbitrary File Deletion in Ultra Addons CF7

Ultra Addons for Contact Form 7 is a widely deployed WordPress plugin for contact form management and PDF generation. CVE-2026-102435 exposes a critical arbitrary file deletion vulnerability in the _getObjAttr function due to insufficient file path validation. It exploits the WPCF7_Submission gadget chain via __destruct() and is accessible to unauthenticated users: it allows deletion of any file on the server, including critical files like wp-config.php, opening the door to remote code execution (RCE).

Severity is declared critical with CVSS 9.8: unauthenticated access, total impact on confidentiality, integrity, and availability. The CVE was published by NVD on 2026-11-02 and has been amplified on social channels since yesterday with consistency regarding CVSS score and affected versions. At the time of publication, no public exploits are reported available, but the simplicity of the exploitation methodology and the breadth of potential impact make immediate patching a priority.

IT administrators and CISOs must immediately identify which WordPress instances have Ultra Addons for Contact Form 7 version 3.5.54 or lower, particularly those with PDF Generator add-on active. The priority action is to upgrade to version 3.5.55 or later.

If immediate patching is not possible, disabling the PDF Generator or Contact Form 7 PDF generation configuration reduces the attack surface. Monitor web access logs for suspicious patterns of requests to contact form endpoints.