Generate PDF CVE-2026-90984

Requires only that the target WordPress site runs the 'Generate PDF using Contact Form 7' plugin before version 4.2.2 with a publicly reachable Contact Form 7 form that triggers PDF generation on submission. No authentication, no user interaction, and no special configuration are needed (PR:N/UI:N) - the attacker directly submits crafted form content whose image/URL destination is fetched server-side without restriction. Practical limits: the plugin must be installed and PDF generation must be invoked on submitted content, the fetched internal service must return data that survives rendering into the PDF, and the site must be patched-below-4.2.2; there is no lateral impact beyond information disclosure (I:N/A:N).

This is a genuine, exploitable network SSRF that warrants prioritization above a typical low-CVSS plugin bug because multiple signals align: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully unauthenticated with low complexity and no user interaction, a public exploit exists (WPScan), and a vendor patch is available. The vendor base score of 5.8 is arguably UNDERSTATED - the vulnerability is a NON-blind SSRF where the internal-resource response is read back through the generated PDF, which functions as an exfiltration channel; that meaningfully increases confidentiality impact beyond the assigned C:L (a case for C:H can be made, pushing my own estimate to ~6.5-7.5). No EPSS score and no KEV listing are provided, so there is no evidence of active in-the-wild exploitation - the risk today is elevated-but-not-emergency: real, unauthenticated, and POC-backed, but not confirmed weaponized at scale. Bottom line: treat as a real priority for internet-facing WordPress sites running this plugin because unauth + POC + response-exfil is a dangerous combination, while noting exploitation status is currently limited to public POC rather than observed attacks.

An unauthenticated attacker submits a Contact Form 7 form whose content references an attacker-chosen internal URL (e.g., a cloud metadata endpoint or an internal admin service); the plugin's PDF renderer fetches that URL server-side and embeds/reflects the response into the generated PDF, which the attacker then reads to exfiltrate internal data. A public POC is available from WPScan, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N the attack requires no authentication, no user interaction, and only a single crafted form submission.