CVE-2026-94664
Received Received - Intake

Path Traversal in PDF for Contact Form 7

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: Patchstack

Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-94664
EUVD
EUVD-2026-95627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
add-ons.org PDF for Contact Form 7 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Path Traversal vulnerability in the PDF for Contact Form 7 WordPress plugin. It allows attackers to access restricted files on the server by manipulating file paths in requests. The vulnerability exists in versions up to 7.1.0.

Detection Guidance

Detecting this Path Traversal vulnerability requires checking for vulnerable versions of the PDF for Contact Form 7 plugin. Inspect WordPress installations for plugin versions <= 7.1.0. Look for unauthorized file downloads or access attempts to restricted directories. Monitor server logs for suspicious requests containing path traversal sequences like '../' or '/etc/passwd'.

Impact Analysis

Attackers could download sensitive files from your server, including configuration files, databases, or other confidential data. This could lead to data breaches, unauthorized access, or further attacks on your system.

Compliance Impact

This vulnerability allows arbitrary file downloads, which could expose sensitive user data stored on the server. For GDPR, this may lead to unauthorized access to personal data, violating principles of data protection and user privacy. For HIPAA, it risks exposing protected health information if such data is stored on the affected system.

Mitigation Strategies

Update the PDF for Contact Form 7 plugin to version 7.2.0 or later to patch the vulnerability. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart