CVE-2025-14356 is an authorization bypass vulnerability in the themefic Ultra Addons for Contact Form 7 plugin for WordPress. The issue stems from the absence of a capability check in the 'uacf7_get_generated_pdf' function, which is responsible for generating PDFs of form submissions. Authenticated users with Subscriber-level privileges or higher can exploit this to access generated PDFs without proper authorization, but only when the "PDF Generator" and "Database" addons are enabled (these are disabled by default). This vulnerability affects all versions up to and including 3.5.33.

An attacker with at least Subscriber-level access can generate and retrieve PDF documents of form submissions without proper authorization. This could lead to unauthorized disclosure of potentially sensitive form data. The impact is limited to confidentiality (partial data exposure) and does not affect integrity or availability. The vulnerability requires authentication and specific addons to be enabled, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the "PDF Generator" and "Database" addons if they are enabled and not essential. Additionally, restrict Subscriber-level user capabilities where possible to limit exposure. Monitor vendor channels for updates and apply patches promptly once available.