PDF for Contact Form 7
PDF for Contact Form 7 generates PDF documents from Contact Form 7 submissions.
PDF for Contact Form 7 (pdf-for-contact-form-7) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Oct 09, 2026; the highest published CVSS base score is 8.8.
pdf-for-contact-form-7CVE-2026-94664: PDF for Contact Form 7: Unauthenticated path traversal and information disclosure
The supplied vector requires no attacker account. Attacker-controlled path input is not confined to the intended directory, permitting access outside that boundary. The vector reports high confidentiality impact without integrity or availability impact. The export does not identify the endpoint, path parameter, filesystem function or readable files, and does not establish writes or code execution. No victim interaction is required by the vector. The vector reports high confidentiality impact, no integrity impact, no availability impact. Affected versions: <= 7.1.0. The authoritative export identifies 7.2.0 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 09, 2026 |
CVE-2026-94664
PDF for Contact Form 7: Unauthenticated path traversal and information disclosure
The supplied vector requires no attacker account. Attacker-controlled path input is not confined to the intended directory, permitting access outside that boundary. The vector reports high confidentiality impact without integrity or availability impact. The export does not identify the endpoint, path parameter, filesystem function or readable files, and does not establish writes or code execution. No victim interaction is required by the vector. The vector reports high confidentiality impact, no integrity impact, no availability impact. Affected versions: <= 7.1.0. The authoritative export identifies 7.2.0 as fixed for this CVE.
|
7.2.0 |
CVE7.5
|
| Dec 18, 2025 |
CVE-2025-60081
PDF for Contact Form 7: Code execution
PDF for Contact Form 7 is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
|
| Dec 12, 2025 |
CVE-2025-14074
PDF for Contact Form 7 + Drag and Drop Template Builder: A security weakness
PDF for Contact Form 7 + Drag and Drop Template Builder is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
|