Pdf For Contact Form 7
Monthly
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.
Unauthenticated remote attackers can read arbitrary files from the underlying web server by exploiting a path traversal flaw in the WordPress plugin PDF for Contact Form 7 (slug pdf-for-contact-form-7) affecting all versions through 7.1.0. Supplying crafted directory-traversal input to the plugin's PDF file-handling/download path lets an attacker escape the intended directory and retrieve files readable by the web server account, a high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). No public exploit code, CISA KEV listing, or EPSS score was identified in the supplied intelligence, so exploitation has not been confirmed as active and the practical attack surface depends on the plugin being installed and activated; note that WordPress core does not ship this plugin, so exposure is limited to sites running it.