CVE-2026-90984: Contact Form 7 PDF Generator SSRF Vulnerability

CVE-2026-90984 Overview

CVE-2026-90984 is a Server-Side Request Forgery (SSRF) vulnerability in the Generate PDF using Contact Form 7 WordPress plugin versions prior to 4.2.2. The plugin's PDF renderer fetches images referenced in submitted form content without restricting the request destination. Unauthenticated attackers can coerce the WordPress server into requesting internal network resources and read the responses back through the generated PDF file. The flaw is classified as [CWE-918] Server-Side Request Forgery and affects the plugin at network reach without requiring authentication or user interaction.

Critical Impact
Unauthenticated attackers can enumerate and read internal network resources, including cloud metadata endpoints and internal HTTP services, through PDF output returned by the plugin.

Affected Products

Generate PDF using Contact Form 7 WordPress plugin versions before 4.2.2
WordPress sites running Contact Form 7 with the vulnerable PDF generation extension
Deployments exposing form submission endpoints to unauthenticated users

Discovery Timeline

2026-09-18 - CVE-2026-90984 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90984

Vulnerability Analysis

The Generate PDF using Contact Form 7 plugin converts submitted Contact Form 7 data into a downloadable PDF document. During rendering, the plugin parses image references contained in submitted content and issues server-side HTTP requests to fetch those images for embedding. The plugin does not validate or restrict the destination of these fetches. An attacker submits a form containing image references pointing to internal hosts, loopback addresses, or cloud metadata endpoints. The server retrieves the response and embeds it in the resulting PDF, which the attacker then reads.

Exploitation requires no authentication. The attack surface is any public form on the target site that uses the vulnerable plugin. The response content is disclosed through the rendered PDF, making this a full-response SSRF rather than a blind variant.

Root Cause

The root cause is missing destination validation on outbound HTTP requests performed by the PDF renderer. The plugin trusts URLs supplied through form input and does not filter private address ranges (RFC 1918), link-local addresses, loopback interfaces, or metadata service hostnames such as 169.254.169.254. See the WPScan Vulnerability Report for advisory details.

Attack Vector

An unauthenticated attacker submits a Contact Form 7 form containing an image reference that points to an internal resource. The server-side PDF renderer resolves the URL, issues an HTTP GET request from the WordPress host, and embeds the response bytes into the PDF. The attacker retrieves the generated PDF and extracts the internal response data. Targets include cloud instance metadata services, internal administrative interfaces, and services bound to 127.0.0.1 on the WordPress host.

No verified exploit code is publicly available. The vulnerability mechanism is described in the referenced WPScan advisory.

Detection Methods for CVE-2026-90984

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to internal IP ranges, loopback addresses, or the 169.254.169.254 metadata endpoint
Contact Form 7 submissions containing image URLs pointing to private address space or non-standard schemes
Unusual PDF generation activity correlated with form submissions from external IP addresses
PHP error or access logs showing outbound fetch attempts to unexpected internal hostnames

Detection Strategies

Inspect web server and PHP access logs for form submissions containing suspicious URL patterns in image fields
Monitor egress traffic from web servers to internal subnets and cloud metadata endpoints
Alert on WordPress plugin versions of Generate PDF using Contact Form 7 below 4.2.2 through asset inventory scans
Correlate spikes in PDF generation events with anomalous outbound HTTP requests from the site's application server

Monitoring Recommendations

Log all outbound HTTP requests initiated by PHP processes and forward them to a central analytics platform
Enable Contact Form 7 submission logging and retain payloads for retrospective analysis
Deploy egress filtering rules that block WordPress hosts from reaching cloud metadata IPs and internal management ranges
Track version drift on WordPress plugins across the estate to identify hosts still exposed

How to Mitigate CVE-2026-90984

Immediate Actions Required

Upgrade the Generate PDF using Contact Form 7 plugin to version 4.2.2 or later on all WordPress installations
Restrict outbound network access from WordPress hosts to internal IP ranges and cloud metadata endpoints
Audit recent PDF generation activity and form submissions for suspicious image URLs
On cloud instances, enforce Instance Metadata Service v2 (IMDSv2) to blunt metadata theft through SSRF

Patch Information

The vendor released version 4.2.2 of the Generate PDF using Contact Form 7 plugin, which addresses the SSRF condition. Administrators should update through the WordPress plugin manager or by deploying the fixed release from the plugin repository. Refer to the WPScan Vulnerability Report for advisory tracking.

Workarounds

Disable the Generate PDF using Contact Form 7 plugin until patching is complete
Place the WordPress host behind an egress proxy that blocks requests to private and link-local address ranges
Remove or restrict public exposure of Contact Form 7 forms that trigger PDF generation
Apply web application firewall rules that reject form submissions containing internal or loopback URLs in image fields

bash

# Example egress restriction using iptables to block metadata and RFC1918 destinations
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT