Send PDF for Contact Form 7 <= 1.0.3.11 - Unauthenticated Path Traversal to Limited File Write via 'wpcf7cfpdf_hidden_reference' Parameter
- ID
- WPSEC-2026-2684
- Plugin
- Send PDF for Contact Form 7 (send-pdf-for-contact-form-7)
- Affected
- from 1.0.1.3 before 1.0.3.12
- Remediation
- Update to 1.0.3.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-07
- Attack surface
- Send PDF for Contact Form 7 on WPSec AttackSurface
- Fix released
- Published
Description
The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal via the 'wpcf7cfpdf_hidden_reference' parameter in all versions up to, and including, 1.0.3.11, due to insufficient sanitization of the client-supplied hidden reference field. The field is only passed through esc_html() before it is concatenated into the paths of the generated PDF and CSV files. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form that has PDF/CSV generation enabled to use directory traversal sequences to write copies of the generated .pdf and .csv files outside the plugin's upload folder, which can overwrite existing files with those extensions in locations the web server can write to.
References
- https://wpsec.com/vuln/WPSEC-2026-2684/
- https://plugins.svn.wordpress.org/send-pdf-for-contact-form-7/tags/1.0.3.12/
- https://wordpress.org/plugins/send-pdf-for-contact-form-7/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS