Threats tagged 'ghsa-68fh-vvhf-6vfx'

The Ultra Addons for Contact Form 7 WordPress plugin versions up to 3.5.54 contain a critical vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path validation in the _getObjAttr function. Exploitation requires the PDF Generator add-on to be active and a Contact Form 7 form configured for PDF generation. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.