CVE-2026-96833

HighCVSS 7.2

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

PHP Object Injection vulnerability in Ultimate Addons for Contact Form 7 plugin up to version 3.5.51, exploitable by users with Editor role. May lead to execution of malicious PHP objects.

Risk Assessment

Risk of remote code execution, site compromise, or privilege escalation.

Recommendation

Update the Ultimate Addons for Contact Form 7 plugin to the latest version with the security fix and restrict access to Editor accounts.

Other vulnerabilities in Ultimate Addons for Contact Form 7

See all

CVE-2026-95586Medium
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.
CVE-2026-65439High
XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.

Original NVD description (English source)

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS