External risk intelligence

Ultra Addons for Contact Form 7 File Deletion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-102435

This vulnerability affects a WordPress plugin used for contact forms. Contact forms are web-based features designed to be publicly accessible on the internet to receive submissions from site visitors. Because the vulnerable functionality is part of an active, public-facing web interface, it is highly likely to be reachable from the internet in common deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a WordPress plugin for contact forms could allow attackers to delete files on your web server, potentially leading to full system compromise if a critical configuration file is targeted and the PDF generator feature is enabled.

Attackers can delete server files.
Protects against unauthorized file deletion.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by targeting a WordPress site where the Ultra Addons for Contact Form 7 plugin is installed and the PDF Generator add-on is active. Without needing any authentication, an attacker can manipulate a Contact Form 7 submission to trigger the vulnerable `_getObjAttr` function. This function fails to properly validate file paths, allowing an attacker to delete arbitrary files on the server. If a critical file like `wp-config.php` is deleted, it could lead to remote code execution.

No authentication required.
Triggers file deletion via form submission.
Risk of arbitrary file deletion and RCE.

Live Threat

Current exploitation, exposure, and threat context

When the PDF Generator add-on is active and a Contact Form 7 form is configured for PDF generation, unauthenticated attackers could delete arbitrary files on the server. This could lead to remote code execution if critical files, like configuration files, are deleted.

Arbitrary file deletion.
Unauthenticated network access.
Server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

WordPress plugin owners and infrastructure teams are likely responsible for addressing this vulnerability. The first step is to identify all WordPress sites using the Ultra Addons for Contact Form 7 plugin, confirm if the PDF Generator add-on is active, and assess business criticality and external reachability to prioritize remediation.

Plugin owners and infrastructure teams.
Verify PDF Generator add-on is active.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ultra Addons for Contact Form 7 plugin?

It is a WordPress extension designed to expand the functionality of the Contact Form 7 plugin. Users typically install it to add features like PDF generation to their forms, allowing site visitors to create downloadable documents from their submissions.

Why is CVE-2026-102435 considered a deserialization weakness?

This CVE is categorized under CWE-502, which involves insecure deserialization. In this case, the plugin improperly handles data during the processing of form submissions. By failing to validate how objects are reconstructed, it allows an attacker to manipulate the process to delete sensitive system files.

How does an attacker trigger this file deletion flaw?

An attacker triggers the bug by sending a crafted request to a site where the PDF Generator add-on is actively enabled. If the PDF generator feature is turned off or not configured for the specific form, the vulnerable code path that leads to this file deletion is not executed.

Is my site at risk if I use this plugin?

According to Halo Surface Signal, this plugin manages forms that are typically placed on public-facing pages to collect user data. Because the functionality is exposed to the internet, it is highly likely that an attacker can reach the vulnerable component directly without needing administrative access.

How do I start securing my server against this threat?

Your first step is to inventory your WordPress installations to see if the Ultra Addons for Contact Form 7 plugin is present. If found, check the settings to see if the PDF Generator add-on is currently active. If it is, you should plan to disable or update the plugin to remove the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.