{
 "id": "WPSEC-2026-2684",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2684/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2684/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2684/index.md",
 "title": "Send PDF for Contact Form 7 <= 1.0.3.11 - Unauthenticated Path Traversal to Limited File Write via 'wpcf7cfpdf_hidden_reference' Parameter",
 "description": "The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal via the 'wpcf7cfpdf_hidden_reference' parameter in all versions up to, and including, 1.0.3.11, due to insufficient sanitization of the client-supplied hidden reference field. The field is only passed through esc_html() before it is concatenated into the paths of the generated PDF and CSV files. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form that has PDF/CSV generation enabled to use directory traversal sequences to write copies of the generated .pdf and .csv files outside the plugin's upload folder, which can overwrite existing files with those extensions in locations the web server can write to.",
 "plugin": {
  "slug": "send-pdf-for-contact-form-7",
  "name": "Send PDF for Contact Form 7",
  "full_name": "Send PDF for Contact Form 7",
  "wordpress_org": "https://wordpress.org/plugins/send-pdf-for-contact-form-7/",
  "advisories_url": "https://wpsec.com/vuln/plugin/send-pdf-for-contact-form-7/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/send-pdf-for-contact-form-7"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.0.1.3",
    "from_inclusive": true,
    "to": "1.0.3.12",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.0.1.3 before 1.0.3.12"
  ]
 },
 "introduced_in": "1.0.1.3",
 "fixed_in": "1.0.3.12",
 "remediation": "Update to 1.0.3.12 or later.",
 "fix_released": "2026-11-05T23:19:57+00:00",
 "published": "2026-11-06T23:41:13+00:00",
 "updated": "2026-11-06T12:02:39.929121+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2684/",
  "https://plugins.svn.wordpress.org/send-pdf-for-contact-form-7/tags/1.0.3.12/",
  "https://wordpress.org/plugins/send-pdf-for-contact-form-7/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/send-pdf-for-contact-form-7",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-07"
 }
}