CVE-2026-94664

HighCVSS 7.5

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The PDF for Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 7.1.0. An attacker can exploit this to read arbitrary files from the server.

Risk Assessment

The risk involves potential disclosure of sensitive data such as passwords, API keys, or customer data.

Recommendation

Immediately update the PDF for Contact Form 7 plugin to the latest version that fixes this vulnerability.

Other vulnerabilities in PDF for Contact Form 7

CVE-2025-14074Medium
The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to and including 6.3.3. Authenticated attackers with Subscriber-level access and above can duplicate arbitrary posts, including password protected or private ones.

Original NVD description (English source)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS