CVE-2024-6316 is a CSRF vulnerability in the Generate PDF using Contact Form 7 WordPress plugin (up to version 4.1.2) caused by missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This flaw allows unauthenticated attackers to upload arbitrary files to the server by tricking an administrator into executing a forged request. The vulnerability can lead to remote code execution if exploited successfully. CVE-2024-37555 is a duplicate of this issue. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected WordPress server, potentially leading to remote code execution if an administrator is tricked into performing an action. This compromises confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical impact on affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the vulnerable plugin or restricting administrative access to trusted users only. Avoid clicking on suspicious links that could trigger forged requests. Monitor official channels from zealopensource for updates and patches.