# Send PDF for Contact Form 7 <= 1.0.3.11 - Unauthenticated Path Traversal to Limited File Write via 'wpcf7cfpdf_hidden_reference' Parameter

- **ID:** WPSEC-2026-2684
- **Plugin:** Send PDF for Contact Form 7 (`send-pdf-for-contact-form-7`), https://wordpress.org/plugins/send-pdf-for-contact-form-7/
- **Affected versions:** from 1.0.1.3 before 1.0.3.12
- **Fixed in:** 1.0.3.12 (Update to 1.0.3.12 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/send-pdf-for-contact-form-7
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2684/

## Description

The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal via the 'wpcf7cfpdf_hidden_reference' parameter in all versions up to, and including, 1.0.3.11, due to insufficient sanitization of the client-supplied hidden reference field. The field is only passed through esc_html() before it is concatenated into the paths of the generated PDF and CSV files. This makes it possible for unauthenticated attackers who submit a Contact Form 7 form that has PDF/CSV generation enabled to use directory traversal sequences to write copies of the generated .pdf and .csv files outside the plugin's upload folder, which can overwrite existing files with those extensions in locations the web server can write to.

## References

- https://wpsec.com/vuln/WPSEC-2026-2684/
- https://plugins.svn.wordpress.org/send-pdf-for-contact-form-7/tags/1.0.3.12/
- https://wordpress.org/plugins/send-pdf-for-contact-form-7/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2684/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.