CVE-2026-94666

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

CVE-2026-94666

The ZealousWeb Generate PDF using Contact Form 7 WordPress plugin (versions n/a through 4.2.1 ) is vulnerable to a Path Traversal vulnerability. This flaw allows an attacker to perform an Arbitrary File Download , potentially exposing sensitive files on the server. No specific remediation steps o...

CVE-2026-94666 WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

EUVD-2026-95625

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

PT-2026-108835

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1...

WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Eunho Kim in WordPress Plugin Generate PDF using Contact Form 7 versions = 4.2.1...

WordPress Generate PDF using Contact Form 7 plugin < 4.2.2 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Artus KG in WordPress Plugin Generate PDF using Contact Form 7 versions 4.2.2...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

EUVD-2026-82683

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin (versions before 4.2.2 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The issue arises because the plugin's PDF renderer does not restrict the destination of image fetches performed on submitted form content. An at...

PT-2026-95256

Name of the Vulnerable Software and Affected Versions Generate PDF using Contact Form 7 versions prior to 4.2.2 Description The plugin fails to restrict the destination of image fetches performed by its PDF renderer on submitted form content. This allows unauthenticated users to execute a...

CVE-2024-6316: Cross-Site Request Forgery (CSRF)

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wpcf7pdfdashboardhtmlpage' function. This makes...

CVE-2024-37555: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through = 4.1.2...

CVE-2024-6317: Cross-Site Request Forgery (CSRF)

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...