On 2 November 2026 Wordfence published a critical flaw in Ultra Addons for Contact Form 7, a plugin with more than 60,000 active installations. It is rated CVSS 9.8, needs no login, and can delete any file on the server, including wp-config.php. A fixed version has been available for weeks, so for most agencies this is a quick check. Here is who is affected, how to check a client site in two minutes, and what to do if a site already looks wrong.
What the flaw is
- Identifier: CVE-2026-102435, CVSS 9.8 (critical), reported through Wordfence.
- Type: unauthenticated PHP object injection through a Contact Form 7 form field, leading to arbitrary file deletion.
- Why it matters: deleting
wp-config.phpputs WordPress back into its installation screen. Whoever completes that screen can point the site at their own database and take it over.
Who is affected
Sites running Ultra Addons for Contact Form 7 version 3.5.54 or older, with the PDF Generator add-on switched on and at least one form set up to generate a PDF. Sites that have the plugin but do not use the PDF feature are not exposed to this chain, but should still update. The current version is 3.5.57; the fix arrived in the releases after 3.5.54.
We found no confirmed attacks in the sources we checked on 5 November 2026. Some security newsletters say exploit details are circulating, and a 9.8 without login is the kind of flaw that gets scanned for quickly. Do not wait for proof of attacks.
Check a site in two minutes
- In wp-admin: Plugins, search for “Ultra Addons”. Note the version. If it is 3.5.54 or lower, open the plugin’s add-on settings and see whether PDF Generator is on.
- With WP-CLI:
wp plugin get ultimate-addons-for-contact-form-7 --field=version. Run it across all client sites to get one list. - Look at the front end: if the site suddenly shows the WordPress installation or “create a configuration file” screen,
wp-config.phpis gone. Treat that as an incident (see below).
What to do now
- Update to 3.5.57 on every site that has the plugin, with or without the PDF feature.
- Test one form after the update. Submit it, check the mail arrives and, if you use PDF generation, that the PDF is attached. Recent releases also changed file upload and PDF handling.
- Cannot update today? Switch off the PDF Generator add-on until you can.
- If a site shows the installation screen: do not complete it. Take the site offline at the host, restore files and database from a backup made before the problem, update the plugin, then change database and admin passwords and the salts in
wp-config.php. Check for unknown administrator accounts and files. Our vulnerability-day routine and restore guide have the full steps.
How Verploy helps
Every update is checked. Risky ones tested on a copy first, including the forms. Known vulnerabilities show up per site with a link to the source, so one dashboard tells you which client sites still run 3.5.54 or older. Nightly encrypted backups in the EU give you a clean point to return to. More on vulnerability monitoring for agencies.
Source: CVE-2026-102435 record (assigner Wordfence), published 2 November 2026, wordfence.com; plugin page and changelog, wordpress.org. Checked 5 November 2026.
Want to see which client sites are exposed, in one list?
Every update is checked, and the risky ones are tested on a copy first. Start free on up to 3 sites, no credit card.