Ultra Addons for Contact Form 7 vulnerability: check, update and recover
Originally published at hamzaahmadaslam.com . How this article was made: drafted with AI assistance from a researched brief, then checked against primary documentation before publishing. The Ultra Addons for Contact Form 7 vulnerability (CVE-2026-102435) affects plugin versions 3.5.54 and earlier when PDF Generator is enabled and a form uses it. Version 3.5.55 fixes the flaw. Check your installed…
The Ultra Addons for Contact Form 7 vulnerability (CVE-2026-102435) impacts plugin versions up to and including 3.5.54 when the PDF Generator feature is active and a Contact Form 7 form is configured to generate PDFs. The flaw is a PHP object injection issue that can result in arbitrary file deletion. No login is required to exploit this vulnerability.
The first updated version addressing the issue is 3.5.55, with a later release (3.5.57) adding additional PDF-related fixes. The wp-config.php file, which contains crucial database connection details, should not be deleted as it could lead to WordPress losing its configuration and potentially show a setup screen.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
