CVE-2026-94664

Summary

This vulnerability allows attackers to perform path traversal attacks on the PDF for Contact Form 7 plugin, potentially enabling them to read arbitrary files from the server's filesystem. This is a high-severity issue because it can lead to sensitive data exposure without requiring any user interaction or authentication.

Exploitability

Exploitation is relatively straightforward with no special preconditions required, as attackers can simply craft malicious requests to access files outside the intended directory scope.

Blast radius

The impact could be significant as attackers might gain access to configuration files, database credentials, or other sensitive application data stored on the server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 7.1.1 or later to remediate this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.