Generate PDF CF7 CVE-2026-94666

Exploitation requires that the 'Generate PDF using Contact Form 7' plugin (version 4.2.1 or earlier) be installed and active on a WordPress site, with its PDF generation/download endpoint reachable by unauthenticated remote requests. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed and no special non-default configuration is indicated in the available data; the practical limiting factor is simply the presence of this specific add-on, which has a comparatively small install base. Impact is bounded to file disclosure (C:H only) - no write/integrity or availability effect - so exploitation enables reading server files, not modifying them.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which maps to the base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N) - consistent with an arbitrary file download/read primitive rather than code execution or data tampering. The Patchstack reference title ('arbitrary file download vulnerability') corroborates this as a confidentiality-only path traversal. No EPSS probability, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated CVSS therefore reflects theoretical ease of exploitation, not demonstrated real-world attacks. Net assessment: a genuinely exploitable unauthenticated file-disclosure bug that warrants prompt patching where the plugin is deployed, but its real-world priority is tempered by the absence of exploitation signals (no KEV, no EPSS, no POC) and the niche footprint of this specific Contact Form 7 add-on. Note the single sourcing: all data traces to one Patchstack advisory, and affected versions ('n/a through 4.2.1') and a fixed version were not independently confirmed.

A remote, unauthenticated attacker sends a crafted request to the plugin's PDF generation/download endpoint containing directory-traversal sequences (e.g. ../../) to escape the intended PDF directory and retrieve arbitrary server files such as wp-config.php, potentially disclosing database credentials and secret keys. No public exploit code is identified in the provided data, but the low attack complexity and lack of authentication (PR:N) make exploitation straightforward once the vulnerable endpoint is located.