The Ultra Addons vulnerability in Ultra Addons for Contact Form 7, a plugin for the WordPress website manager, scores 9.8 out of 10 on the NVD record published November 2, 2026. If your site uses it, have the installed version checked and disable the plugin’s PDF generation feature.
What is it?
A flaw in the Ultra Addons for Contact Form 7 plugin lets an outsider, with no account or password, trigger the deletion of files from the site. Its official identifier is CVE-2026-102435.
A WordPress site is built from parts: the theme forms the storefront, plugins provide the features. Here, one of those parts accepts requests from outside without checking carefully enough what it’s about to touch. It’s like leaving a key under the doormat: the door looks locked, but anyone who knows where to look walks right in. When essential files disappear, the site can go down or fall under the control of whoever got in. The record comes from the NVD, the public vulnerability database maintained by NIST, the U.S. standards body. It specifies that the problem only occurs if PDF generation is active. It also requires a Contact Form 7 form to be used to produce these documents, the fixed files typically sent by email.
Why is it serious?
9.8 out of 10: that is the CVSS 3.1 score assigned by the reporting organization (CNA) and reflected in the NVD record. No exploitation is reported in the records reviewed.
The fact that no credentials are required is one factor behind the severity: no account or password stands in the way. That factor alone, however, does not explain the score. In business terms, possible consequences include a storefront website going offline and incoming customer inquiries no longer arriving. Added to that are personal information submitted through forms becoming exposed, and a site hijacked to host fraud carried out under your name. Recall that in Quebec, private sector privacy legislation requires organizations to keep a register of confidentiality incidents. In some cases, it also requires notifying the Commission d’accès à l’information (Quebec’s privacy regulator). We want to stress: as of now, nothing has been reported in the records reviewed, and that does not allow anyone to predict what comes next.
Who is affected?
WordPress sites running the Ultra Addons for Contact Form 7 plugin by themefic, in all versions up to and including 3.5.54.
The fixed version is not specified in the records reviewed: it should be confirmed with themefic or through the official WordPress plugin directory. This can affect any local business whose site was built on WordPress: clinics, garages, professional service firms, retailers, and non-profit organizations. An organization does not always know which plugins are running on its site, since that choice is often left to the agency that built it.
How do I check my business?
Have your IT provider or web agency carry out the checks below, without delay.
- Have the list of installed plugins and their current versions drawn up (IT provider or web agency).
- Check whether PDF generation is enabled in this plugin and whether a form is used to produce PDFs (IT provider).
- Ask the developer, themefic, or check the official plugin directory, which version fixes the vulnerability (provider or software vendor).
- Confirm that a recent backup of the site and its configuration exists and has already been tested (management, with the provider).
Scenario
Fictional example: a regional dental clinic whose site had not been updated.
On a Tuesday morning, the site stops responding. The online appointment form has disappeared, along with the requests received the day before. Two days later, the clinic has to explain to its patients that information submitted through the form may have been accessed.
What the Ultra Addons Vulnerability Means for a Local Business
For a Quebec business, a website is not a brochure: it is a sales channel and a repository of customer information. A plugin patch then becomes a management decision.
What to do now
- Ask today for the list of plugins and versions used on your site.
- Disable this plugin’s PDF generation feature until a fixed version is confirmed.
- Confirm with the developer, or through the official plugin directory, that a fixed version is available, then install it after taking a backup.
- Add plugin updates to a tracked routine, with a named responsible person.
- Test your backups by performing a trial restore.
FAQ
No exploitation has been reported: should we act right away?
Yes. An absence of reported exploitation is a snapshot of the moment, taken from the records reviewed, not a guarantee. With a score of 9.8 out of 10 and an attack that requires no password, it is better to act calmly now.
We only have a small storefront site. Are we a target?
Size does not provide protection. The Canadian Centre for Cyber Security notes that all Canadian organizations are exposed, regardless of sector or number of employees.
Does disabling PDF generation fix the problem?
It significantly reduces exposure: the NVD record specifies that the vulnerability only occurs when this feature is active. It is not a substitute for updating: the fixed version should be installed as soon as the developer confirms it. Keep in mind that no protection is absolute: no serious provider promises zero risk.
Sources
- CVE-2026-102435 record, National Vulnerability Database · NIST, November 2, 2026
- Canadian Centre for Cyber Security: ransomware threat overview, 2025 to 2027 · exposure of all Canadian organizations
- Commission d’accès à l’information du Québec (Quebec’s privacy regulator) · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-102435
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
