High · 7.2 CVE-2026-96833 EUVD-2026-89885GHSA-w53v-75gj-cm6q

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: themefic Product: Ultimate Addons for Contact Form 7

Description

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Affected products

Vendor	Product	Affected	Fixed
Themefic	Ultimate Addons for Contact Form 7	≤ 3.5.51	—

References

https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-51-php-object-injection-vulnerability?_s_id=cve vdb-entry