Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2026-96833 Details
Description
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
A PHP object injection vulnerability has been identified in the Ultimate Addons for Contact Form 7 plugin, affecting versions through 3.5.51. This vulnerability allows for object injection, which could be exploited to manipulate or control the behavior of the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 30, 2026Exploitation: NoneAutomatable: NoTechnical Impact: Partial
CISA-ADP
Assessed Sep 30, 2026Exploitation: NoneAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ultimate Addons for Contact Form 7 | <= 3.5.51 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 30, 2026 | New CVE Received | [email protected] |