Ultra Addons for Contact Form 7 through 3.5.54 – Actively Exploited File Deletion to RCE (CVE-2026-102435)

Patch immediately: Ultra Addons for Contact Form 7 versions through 3.5.54 contain an unauthenticated PHP object injection and arbitrary file deletion vulnerability tracked as CVE-2026-102435. Patchstack lists it among recently exploited WordPress vulnerabilities. The initial fix is version 3.5.55; administrators should install the current 3.5.57 release or later.

Exploit path and prerequisites

The vulnerable PDF generation flow did not adequately validate a path used by its object attribute handling. A remote visitor can supply crafted form data that reaches a PHP object injection gadget chain and deletes an arbitrary file. Deleting wp-config.php can expose the WordPress installer and create a path to full site takeover and remote code execution.

Wordfence notes that exploitation requires the PDF Generator add-on to be active, a Contact Form 7 form configured for PDF generation, and the relevant submission gadget chain to be reachable. Sites not using the PDF feature have less exposure, but all affected installations should still update.

Active exploitation status

Patchstack marks CVE-2026-102435 as known to be exploited in its recently exploited WordPress list. This is Patchstack exploitation telemetry and is not a claim that the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog.

Immediate remediation

1. Update Ultra Addons for Contact Form 7 to 3.5.57 or the newest release.
2. Disable PDF Generator on all affected forms until the update is complete and verified.
3. Confirm wp-config.php exists, has expected ownership and permissions, and has not been recreated or altered.
4. Review administrator users, site URLs, database credentials, salts, scheduled tasks and recently changed PHP files.
5. If configuration deletion or installer access is detected, isolate the site and rotate all WordPress, database, hosting and API credentials after rebuilding from known-good files.

wp plugin get ultimate-addons-for-contact-form-7 --fields=name,status,version,update,update_version
wp plugin update ultimate-addons-for-contact-form-7
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_registered

Temporary mitigation only: If the patch cannot be deployed immediately, deactivate Ultra Addons for Contact Form 7 or disable its PDF Generator feature and the associated public forms. Preserve logs before cleanup. A WAF can reduce probing but does not replace the vendor update.

Indicators and verification

• Unusual serialized or object-like values submitted to public Contact Form 7 forms with PDF generation.
• Missing, recently recreated or unexpectedly modified wp-config.php.
• Requests to wp-admin/setup-config.php or wp-admin/install.php on an established site.
• Changed database settings, home/site URL values, unfamiliar administrators, or new PHP files.
• Unexpected errors or path-related messages from PDF generation immediately before configuration changes.

Verify version 3.5.57 or later is active, test PDF generation after updating, and examine web, WAF and application logs around the first suspicious form submission. Compare critical files with a known-good backup and verify core and plugin checksums wherever supported.

Sources

• Patchstack vulnerability record and exploitation status
• Wordfence Intelligence technical record
• Official plugin release page and changelog