CVE-2026-102435 - Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
CVE ID :CVE-2026-102435 Published : Nov. 2, 2026, 8:17 p.m. | 46 minutes ago Description :The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and...