CVE-2026-94664: PDF for Contact Form 7 Path Traversal

CVE-2026-94664 Overview

CVE-2026-94664 is a path traversal vulnerability in the PDF for Contact Form 7 WordPress plugin by add-ons.org. The flaw affects all versions up to and including 7.1.0. An unauthenticated attacker can send crafted requests over the network to read arbitrary files outside the plugin's intended directory. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Patchstack classifies the issue as an arbitrary file download vulnerability, meaning attackers can retrieve sensitive files such as wp-config.php from the WordPress host.

Critical Impact
Unauthenticated remote attackers can download arbitrary files from the WordPress server, exposing database credentials, authentication keys, and other sensitive configuration data.

Affected Products

PDF for Contact Form 7 WordPress plugin by add-ons.org
All versions from n/a through 7.1.0
WordPress sites running the vulnerable pdf-for-contact-form-7 plugin

Discovery Timeline

2026-10-09 - CVE-2026-94664 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-94664

Vulnerability Analysis

The PDF for Contact Form 7 plugin generates PDF attachments from Contact Form 7 submissions. The plugin exposes a file-handling endpoint that accepts a user-controlled file path parameter. Insufficient validation of this parameter allows attackers to escape the intended directory using traversal sequences such as ../.

An unauthenticated attacker can request files anywhere on the filesystem that the web server process can read. Typical targets include wp-config.php, .htaccess, SSH keys, and system files like /etc/passwd. Exposure of wp-config.php yields database credentials and WordPress secret keys, enabling further compromise of the site and database.

The attack requires no authentication, no user interaction, and low attack complexity. Confidentiality impact is high, while integrity and availability are not directly affected.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin passes untrusted input to file-read operations without canonicalizing the path or verifying that the resolved location stays within an approved base directory. Normalization checks that would reject sequences like ../ or absolute paths are missing.

Attack Vector

The attack is delivered over HTTP(S) against the plugin's download handler. An attacker crafts a request that supplies a traversal payload in the file parameter consumed by the plugin. The web server returns the contents of the targeted file in the HTTP response. No credentials or session context are required. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-94664

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/pdf-for-contact-form-7/ containing ../, ..%2f, or URL-encoded traversal sequences
Requests whose file parameters reference sensitive filenames such as wp-config.php, .htaccess, id_rsa, or /etc/passwd
Unexpected outbound responses containing WordPress database credentials or secret keys originating from the plugin handler

Detection Strategies

Inspect web server access logs for requests to plugin URLs that include traversal patterns or absolute paths in query parameters
Deploy Web Application Firewall (WAF) rules that block directory traversal sequences targeting WordPress plugin endpoints
Alert on HTTP 200 responses from the plugin that return non-PDF Content-Type values or unusually small or large payload sizes

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php and other sensitive files to detect post-exploitation changes
Monitor WordPress audit logs for new administrator accounts or plugin installations that could follow credential theft
Correlate access log anomalies with database authentication events to identify credential reuse by attackers

How to Mitigate CVE-2026-94664

Immediate Actions Required

Deactivate and remove the PDF for Contact Form 7 plugin until a patched version above 7.1.0 is installed
Rotate WordPress database credentials and regenerate all keys and salts in wp-config.php on affected sites
Review access logs for prior exploitation attempts and treat any successful file download as a confirmed compromise

Patch Information

At publication, the advisory lists versions through 7.1.0 as vulnerable. Site administrators should monitor the Patchstack Vulnerability Report and the WordPress.org plugin page for a fixed release and update immediately once available.

Workarounds

Block requests to the plugin's download endpoint at the WAF or reverse proxy layer until a patch is available
Restrict web server filesystem permissions so the PHP worker cannot read files outside the WordPress document root
Apply virtual patching rules that reject requests containing ../, ..\\, or encoded traversal variants targeting /wp-content/plugins/pdf-for-contact-form-7/

bash

# Example ModSecurity rule to block path traversal against the vulnerable plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/pdf-for-contact-form-7/" \
  "id:1026094664,phase:2,deny,status:403,log,\
   chain,msg:'CVE-2026-94664 Path Traversal attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.%2f|%2e%2e/|/etc/|wp-config\.php)" \
      "t:lowercase,t:urlDecodeUni"