CVE-2026-94666

HighCVSS 7.5

Published: 09/10/2026(UTC)Updated: 11/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The Generate PDF using Contact Form 7 plugin for WordPress contains a Path Traversal vulnerability in versions up to and including 4.2.1. This allows an attacker to access files outside the application directory.

Risk Assessment

The risk includes the possibility of reading sensitive files on the server, such as configuration files or user data.

Recommendation

Update the Generate PDF using Contact Form 7 plugin to the latest version to prevent exploitation.

Other vulnerabilities in Generate PDF using Contact Form 7

CVE-2026-90984Medium
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.

Original NVD description (English source)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS