This vulnerability in ZealousWeb's 'Generate PDF using Contact Form 7' plugin allows an attacker with privileges to upload files without restriction on file type, including potentially dangerous types. This can lead to severe impacts such as full system compromise. The CVSS 3.1 vector indicates the attack requires network access and privileges but no user interaction, with a scope change and high impact on confidentiality, integrity, and availability. The affected versions are up to and including 4.1.2. No official patch or mitigation details have been published yet.

Successful exploitation could allow an attacker with privileges to upload malicious files, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, data modification, or denial of service. The vulnerability is rated critical with a CVSS score of 9.6.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict upload privileges to trusted users only and monitor for suspicious file uploads. Avoid allowing untrusted users to upload files through this plugin.