CVE-2026-94666

Summary

This vulnerability allows attackers to perform path traversal attacks on the Generate PDF using Contact Form 7 plugin, potentially enabling them to read arbitrary files from the server's filesystem. This is a high-severity issue because it can lead to sensitive data exposure without requiring authentication.

Exploitability

Exploitation is relatively straightforward with no special preconditions needed, as the vulnerability affects an unauthenticated endpoint that allows traversal beyond the intended directory boundaries.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive files like configuration files, database credentials, or other system files that might contain critical business or personal data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 4.2.2 or later to remediate this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.