{"id":"CVE-2026-94664","published":"2026-10-09T10:16:41.420","lastModified":"2026-10-09T21:17:07.393","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pdf-for-contact-form-7/vulnerability/wordpress-pdf-for-contact-form-7-plugin-7-1-0-arbitrary-file-download-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform path traversal attacks on the PDF for Contact Form 7 plugin, potentially enabling them to read arbitrary files from the server's filesystem. This is a high-severity issue because it can lead to sensitive data exposure without requiring any user interaction or authentication.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as attackers can simply craft malicious requests to access files outside the intended directory scope.","blast_radius":"The impact could be significant as attackers might gain access to configuration files, database credentials, or other sensitive application data stored on the server.","remediation":"Upgrade to version 7.1.1 or later to remediate this path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","web","wordpress","file-access"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:03:16.936Z"}}