CVE-2026-94664 in PDF for Contact Form 7 Plugin
Summary
by MITRE • 10/09/2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw represents a classic path traversal vulnerability within the PDF generation module of the PDF for Contact Form 7 WordPress plugin, specifically affecting versions ranging from initial releases up to version 7.1.0. This type of vulnerability arises when an application fails to properly sanitize or validate user-supplied input before using it as part of a file system operation. In this specific context, the flaw is located in how the add-on handles filenames or directory paths associated with PDF documents generated from contact form submissions. When a user submits a form that triggers the creation of a PDF attachment, the plugin constructs a path to save or retrieve this document. If the input validation logic is insufficient, an attacker can manipulate the filename parameter by injecting special characters such as dot-dot-slash sequences. These sequences allow the file system interpreter to navigate upward from the intended directory structure into parent directories on the server's operating system.
From a technical perspective, the core issue lies in the improper limitation of pathname access to restricted directories. The software does not adequately restrict the scope of files that can be accessed or written based on user input. By exploiting this weakness, an attacker can read arbitrary files from the web server if they have write permissions for the target directory, or potentially overwrite critical system files if write privileges are granted in a vulnerable location. This behavior aligns directly with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The vulnerability enables unauthorized access to sensitive data stored outside the web root, such as configuration files containing database credentials, other plugin source code, or server environment variables. In severe cases where file write operations are involved and directory traversal is successful against writable paths, it could lead to remote code execution if an attacker can upload a malicious script into a location that is subsequently executed by the web server.
The operational impact of this vulnerability extends beyond simple data leakage. It compromises the confidentiality and integrity of the entire WordPress installation hosting the vulnerable plugin. Attackers can use path traversal as a stepping stone for further exploitation, such as reading wp-config.php to extract database passwords, which may lead to full site compromise if those credentials are reused elsewhere or if the database contains administrative accounts that can be targeted with credential stuffing attacks. Furthermore, depending on the server configuration and file permissions, an attacker might overwrite existing files, leading to defacement or service disruption. This vulnerability is particularly dangerous because it often does not require authentication in scenarios where form submissions are publicly accessible, allowing unauthenticated attackers to probe for weaknesses remotely.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary recommendation is to update the PDF for Contact Form 7 plugin to a version later than 7.1.0, assuming the developer has released a patch that implements proper input validation and path canonicalization techniques. If an updated version is not immediately available or applicable, administrators should consider disabling the specific functionality that triggers the vulnerability until it can be patched. Implementing web application firewall rules that detect and block common path traversal patterns in HTTP requests can provide a temporary layer of defense. Additionally, server-level hardening measures such as restricting file permissions to prevent writing outside designated directories and configuring PHP settings like open_basedir can limit the blast radius of any successful exploitation attempt. Regular security audits and code reviews focusing on file handling operations are essential to preventing similar issues in future updates or custom integrations involving this plugin ecosystem.