CVE-2024-6316: Generate PDF Using Contact Form 7 CSRF Flaw

CVE-2024-6316 Overview

CVE-2024-6316 affects the Generate PDF using Contact Form 7 plugin for WordPress in all versions up to and including 4.1.2. The plugin's wp_cf7_pdf_dashboard_html_page function lacks both nonce validation and file type validation, exposing it to Cross-Site Request Forgery (CSRF) leading to arbitrary file upload [CWE-352]. Unauthenticated attackers can upload arbitrary files to the server if they trick a site administrator into clicking a crafted link. Successful exploitation can lead to remote code execution on the WordPress host. CVE-2024-37555 is a duplicate of this issue.

Critical Impact

An unauthenticated attacker can achieve remote code execution on the WordPress server by tricking an administrator into clicking a malicious link.

Affected Products

• Zealousweb Generate PDF using Contact Form 7 plugin for WordPress
• All versions up to and including 4.1.2
• WordPress sites running the vulnerable plugin with administrator interaction

Discovery Timeline

• 2024-07-09 - CVE-2024-6316 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-6316

Vulnerability Analysis

The vulnerability resides in the wp_cf7_pdf_dashboard_html_page function of the Generate PDF using Contact Form 7 plugin. The function handles administrative file upload operations but omits two essential controls: a WordPress nonce check and a file type restriction. Without nonce validation, the plugin cannot verify that an authenticated request originated from a legitimate administrator session. Without file type validation, any extension, including executable PHP scripts, can be written to disk.

An attacker crafts a malicious page that submits a forged POST request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the request using the administrator's session cookies. The plugin processes the upload as if it were a legitimate administrative action and writes the attacker-supplied file to the WordPress filesystem.

Because the uploaded file can be a PHP web shell, the attacker can then request the file directly via HTTP and execute arbitrary code in the context of the web server.

Root Cause

The root cause is a missing CSRF token check combined with absent server-side MIME and extension validation in the wp_cf7_pdf_dashboard_html_page handler. WordPress provides wp_verify_nonce and check_admin_referer helpers, neither of which is called in the vulnerable code path. The handler accepts and stores the uploaded file without inspecting its type against an allowlist.

Attack Vector

Exploitation requires user interaction from a logged-in administrator. The attacker hosts a page containing an auto-submitting form or an XMLHttpRequest that targets the plugin's admin endpoint. Social engineering through email, chat, or a comment link is sufficient to deliver the trigger. Once the file is uploaded, the attacker accesses it directly under the WordPress uploads or plugin directory to execute code.

No synthetic exploit code is published here. For technical references, see the WordPress Plugin Template File and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-6316

Indicators of Compromise

• New or unexpected files with .php, .phtml, or .phar extensions inside the wp-content/uploads/ directory or the plugin's own folders.
• POST requests to the plugin's admin pages (admin.php?page=wp_cf7_pdf_*) lacking a valid _wpnonce parameter in access logs.
• Outbound connections initiated by the www-data or PHP-FPM process to unfamiliar hosts following an admin session.
• Unexpected modifications to WordPress core files, wp-config.php, or scheduled tasks (wp_cron entries).

Detection Strategies

• Audit the WordPress plugins directory for generate-pdf-using-contact-form-7 versions <= 4.1.2 using wp plugin list or filesystem inspection.
• Hunt web server logs for HTTP referers pointing to external domains immediately preceding upload requests to the plugin endpoint.
• Compare uploaded file hashes against a baseline and flag any executable script types written into media directories.
• Inspect HTTP responses from wp_cf7_pdf_dashboard_html_page for success codes accompanied by file path disclosure.

Monitoring Recommendations

• Forward Apache or Nginx access logs and WordPress audit logs to a centralized logging platform for correlation.
• Alert on PHP execution originating from upload directories, which legitimate WordPress workflows do not require.
• Track administrator browser activity across cross-origin requests to high-privilege admin endpoints.
• Monitor for file integrity changes on the WordPress installation using checksum-based tooling.

How to Mitigate CVE-2024-6316

Immediate Actions Required

• Update the Generate PDF using Contact Form 7 plugin to a version newer than 4.1.2 immediately on all WordPress instances.
• If patching is not possible within the same maintenance window, deactivate and remove the plugin until it can be updated.
• Review the wp-content/uploads/ and plugin directories for unauthorized files written since the plugin was installed.
• Rotate WordPress administrator credentials and invalidate active sessions on any site that exhibits indicators of compromise.

Patch Information

The vendor addressed the issue in the plugin source tree as documented in WordPress Plugin Changeset #3146943. The fix introduces nonce verification and restricts accepted file types in the wp_cf7_pdf_dashboard_html_page handler. Administrators should upgrade through the WordPress plugin dashboard or via wp-cli.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce CSRF exposure.
• Configure a Web Application Firewall rule to block POST requests to plugin admin endpoints that lack a valid _wpnonce parameter.
• Disable PHP execution inside wp-content/uploads/ using web server configuration directives.
• Require administrators to use isolated browser profiles or sessions when managing WordPress to limit cross-site request abuse.

# Update the plugin via wp-cli on the WordPress host
wp plugin update generate-pdf-using-contact-form-7

# Verify the installed version is no longer vulnerable
wp plugin get generate-pdf-using-contact-form-7 --field=version

# Optional: block PHP execution in uploads (Nginx example)
# location ~* /wp-content/uploads/.*\.php$ { deny all; }