The name is org.owasp.webgoat.lessons.vulnerablecomponents.Contact not org.owasp.webgoat.vulnerablecomponents.Contact