Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · generate-pdf-using-contact-form-7
Generate PDF using Contact Form 7
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 9, 2026Generate PDF using Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-94666 · affects up to 4.2.1 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.
Sep 18, 2026Generate PDF using Contact Form 7: Does not restrict the destination of the image fetch its PDF renderer performs on submitted form contentCVE-2026-90984 · fixed in 4.2.2 · reported by WPScanMedium 5.8
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6317 · affects up to 4.1.2 · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Cross-Site Request Forgery to Arbitrary File UploadCVE-2024-6316 · affects up to 4.1.2 · reported by WordfenceHigh 8.8
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024Generate PDF using Contact Form 7: Unrestricted Upload of File with Dangerous TypeCVE-2024-37555 · affects up to 4.1.2 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.