Ultra Addons CVE-2026-102435

Exploitation requires a non-default configuration: the PDF Generator add-on of the plugin must be active AND at least one Contact Form 7 form must be configured for PDF generation, because the WPCF7_Submission POP gadget chain depends on Contact Form 7 being present to complete the file deletion via __destruct(). The vulnerability is explicitly stated to be exploitable only when the PDF generator feature is enabled. Given CVSS PR:N/UI:N, once those conditions are met the flaw is reachable by unauthenticated network attackers with no user interaction against affected versions up to and including 3.5.54. The limiting factor is therefore the add-on/feature configuration rather than authentication; installs without the PDF generator enabled are not exploitable.

Signals are strongly aligned toward high priority but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated, low-complexity exploitation with full C:H/I:H/A:H impact, consistent with the 9.8 base score and the CWE-502 deserialization-to-file-deletion-to-RCE chain. The vuln.today decision label is act_now and the finding is reported by Wordfence, a credible WordPress-vulnerability source. No CISA KEV status and no EPSS score are present in the input, so active-exploitation probability cannot be quantified from the data provided - the urgency rests on the act_now label and the severity, not on observed exploitation. The one qualifier the raw CVSS does not capture is the deployment precondition: exploitation requires the PDF Generator add-on to be active and a Contact Form 7 form configured for PDF generation, so the effective attack surface is the subset of installs with that feature enabled rather than every install of the plugin. Within that configured subset the base-metric picture (unauthenticated, network, low complexity, RCE outcome) is accurate and this is a genuine priority, not a high-CVSS-but-low-real-risk case.

An unauthenticated attacker locates a WordPress site running the plugin with the PDF Generator add-on active and a Contact Form 7 form set up for PDF generation, then submits a crafted request carrying a serialized payload that is deserialized by the vulnerable _getObjAttr path. The WPCF7_Submission POP gadget chain fires on __destruct() and, because file-path validation is insufficient, deletes an attacker-chosen file such as wp-config.php, which can be leveraged into remote code execution. No confirmed working exploit code is identified in the provided data; references point to the Wordfence advisory and the plugin source/changeset only.