PDF for CF7 CVE-2026-94664

Target must run the 'PDF for Contact Form 7' (pdf-for-contact-form-7) WordPress plugin at version 7.1.0 or earlier; the attacker reaches the plugin's PDF file-download/handler endpoint and supplies directory-traversal input in a path/filename parameter to read files outside the intended directory. The supplied CVSS vector indicates no authentication, user interaction, or special configuration is required (PR:N/UI:N), so default installations of the affected plugin versions are exposed. Limiting factors: exploitation depends on the vulnerable plugin being installed and activated (not WordPress core), impact is confined to reading files the web server account can access (confidentiality only - no write or code execution), and if the vendor advisory reveals an authentication or form-submission prerequisite not reflected in the vector, the realistic attack surface is narrower than PR:N suggests.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated path traversal with high confidentiality impact and no integrity or availability impact - consistent with the Patchstack reference title 'arbitrary file download vulnerability.' No EPSS score, CISA KEV listing, POC flag, or SSVC decision data was supplied in the input, so exploitation probability and automatability cannot be quantified from the provided signals; there is no public exploit identified at time of analysis. The risk profile is therefore a classic information-disclosure flaw: serious because it can be triggered remotely without credentials and can expose arbitrary server files (e.g., wp-config.php with database credentials and secret keys), but its real-world priority is tempered by a confidentiality-only impact (no code execution or data modification) and by the fact that it affects a specific Contact Form 7 add-on rather than a ubiquitous platform. One caveat to verify: Patchstack-sourced WordPress 'arbitrary file download' issues in form add-ons often require reaching an authenticated or form-submission-gated download endpoint, yet the supplied vector asserts PR:N - if the vendor advisory indicates any privilege or form-interaction prerequisite, the true exploitability is lower than PR:N implies, so confirm the auth precondition against the Patchstack advisory before treating this as fully unauthenticated.

A remote attacker sends a crafted request to the plugin's PDF generation/download handler containing directory-traversal sequences (e.g., ../../) in a filename or path parameter, causing the server to return a file outside the intended directory. By retrieving wp-config.php or other sensitive files, the attacker harvests database credentials and WordPress secret keys for follow-on compromise. No public exploit code was identified in the provided data, but the low attack complexity and network vector make reliable exploitation straightforward once the vulnerable parameter is located.