The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to and including 3.5.54. This flaw allows unauthenticated attackers to delete any file on the server, and if critical files such as wp-config.php are removed, the attacker can achieve remote code execution. The vulnerability is triggered through the PDF Generator add‑on and requires a Contact Form 7 form configured to generate PDFs, leveraging the WPCF7_Submission POP gadget chain and its <<destruct> method.

All installations of Themefic Ultra Addons for Contact Form 7 up to and including version 3.5.54 are affected. The vulnerability applies to the WordPress plugin with the PDF Generator add‑on enabled, and it is relevant for any WordPress instance that uses this plugin version.

With a CVSS score of 9.8, the flaw is a critical security risk. The lack of an EPSS score does not diminish the potential exposure; the vulnerability can be exploited over the network by submitting a crafted form, requiring no authentication. Because the exploit hinges on the PDF Generator add‑on being enabled, many sites using the plugin may inadvertently expose themselves. The capability to delete arbitrary files and the possibility of remote code execution make this a high‑priority issue despite its need for the specific configuration.