$
EGP
CVE-2026-102435 is a critical vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin (versions up to and including 3.5.54). On affected sites it can let an unauthenticated visitor delete important files. In the worst case—especially with older Contact Form 7 versions—that can lead to a full site takeover.
On Brmgina cPanel hosting, Imunify360 already blocks known exploit attempts for this issue at the server firewall (WAF). You should still update the plugins on every WordPress site that uses them.
What is affected?
- Plugin: Ultra Addons for Contact Form 7, versions 3.5.54 and earlier
- Fixed in: Ultra Addons 3.5.55 or later
- Risk level: Critical (CVSS 9.8)
A site is exploitable only when the plugin’s PDF Generator add-on is enabled and a form is set up to generate PDFs. Sites that do not use that PDF feature are not exposed to this specific attack path.
Why it matters
The flaw is a PHP object injection in the PDF Generator. A crafted form submission can trick Contact Form 7 cleanup code into deleting files the attacker chooses—without needing a WordPress login.
- With Contact Form 7 older than 6.1.1, deletion can reach critical files such as
wp-config.php, which may allow a full takeover. - With Contact Form 7 6.1.1+, deletion is limited more tightly (for example inside
wp-content), but the site can still be damaged (plugins, themes, uploads).
Public exploit attempts against Contact Form 7 sites have already been observed (including against servers protected by Imunify360). The firewall helps, but it is not a substitute for updating.
How Brmgina / Imunify360 protects your site
Imunify360’s server-level WAF includes a virtual patch for CVE-2026-102435. It recognizes malicious requests and blocks them before the vulnerable plugin handles them—so the dangerous object is not rebuilt and files are not deleted by that attack path.
Important: the WAF rule blocks the attack; it does not update the plugin for you. Keep Ultra Addons and Contact Form 7 current.
What you should do on your WordPress site
- Update Ultra Addons for Contact Form 7 to 3.5.55 or later.
- Update Contact Form 7 to the latest version (6.1.1 or later already reduces the worst takeover path via
wp-config.php). - If you cannot update Ultra Addons immediately, turn off the PDF Generator add-on until you can update—this removes the exposure for this CVE.
- After updating, confirm forms that need PDFs still work as expected.
You can update from WordPress Admin → Plugins, or ask Brmgina support if you need help checking a site on your hosting account.
Quick checklist
| Situation | What it means |
|---|---|
| Ultra Addons ≤ 3.5.54 + PDF Generator in use | Update now (or disable PDF Generator until you can) |
| Ultra Addons 3.5.55+ | Fixed for this CVE—still keep Contact Form 7 updated |
| Hosting on Brmgina with Imunify360 WAF | Known exploit attempts are blocked; update plugins anyway |
Conclusion
CVE-2026-102435 is a critical issue in Ultra Addons for Contact Form 7 when PDF generation is enabled. Imunify360 on Brmgina servers blocks known exploit traffic, but the lasting fix is updating Ultra Addons to 3.5.55+ and keeping Contact Form 7 current.
Source / further reading: Imunify360: blocks exploits for Contact Form 7 CVE-2026-102435.
