CVE-2026-96833: WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Affected Software
1 affected component
WordPress Ultimate Addons for Contact Form 7<=3.5.51
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ultimate Addons for Contact Form 7to a version that resolves this vulnerability.Fixed in 3.5.52
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires editor-level privileges. The available data does not indicate that unauthenticated or lower-privileged users can trigger it.
2
Which plugin versions are affected?
Ultimate Addons for Contact Form 7 versions 3.5.51 and earlier are affected.
3
What is the potential impact?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. It is network-accessible, has low attack complexity, and does not require user interaction.