The Generate PDF using Contact Form 7 plugin for WordPress suffers from a CSRF vulnerability (CWE-352) in the 'wp_cf7_pdf_dashboard_html_page' function. The plugin lacks nonce validation and does not properly validate file paths before deleting files. This flaw allows unauthenticated attackers to craft forged requests that cause arbitrary file deletion, including sensitive files such as wp-config.php. Successful exploitation requires tricking a site administrator into performing an action, which can lead to site compromise and remote code execution. The vulnerability affects versions up to and including 4.1.2 and has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

An attacker can delete arbitrary files on the affected WordPress site, including critical configuration files like wp-config.php. This can result in site takeover and remote code execution if an administrator is tricked into executing a malicious request. The vulnerability requires user interaction (UI:R) but no privileges or authentication (PR:N). The high CVSS score reflects the potential for complete compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider disabling or removing the affected plugin. Monitoring for updates from the vendor zealopensource is recommended to apply an official fix once released.