CVE-2026-102435

{
  "etk_id": "ETK-2026-3307",
  "cve_id": "CVE-2026-102435",
  "display_id": "CVE-2026-102435",
  "ghsa_id": "GHSA-68fh-vvhf-6vfx",
  "euvd_id": "EUVD-2026-115544",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file deletion in Ultra Addons for Contact Form 7",
  "summary": "Ultra Addons for Contact Form 7 versions through 3.5.54 may allow an unauthenticated remote attacker to delete files on the WordPress server. Deleting certain application files could enable subsequent code execution. Exposure requires the PDF Generator add-on and PDF generation on a Contact Form 7 form to be enabled.",
  "mitigation": "Disable the PDF Generator add-on or turn off PDF generation for Contact Form 7 forms until a vendor update is available. No corrected release is recorded in the advisory; monitor for and apply a vendor-provided fix promptly.",
  "vendor": "themefic",
  "product": "Ultra Addons for Contact Form 7",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.5.54"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ultra Addons for Contact Form 7",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.00996465,
  "t0_at": "2026-11-02T19:31:31.082000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-02T20:12:06.457928+00:00",
      "days": 0.028187221388888888,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T19:31:31.082000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-02T19:31:31.082000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T19:31:31.082000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102435"
    }
  }
}