This vulnerability in the WordPress plugin 'Contact Form 7 PDF, Google Sheet & Database' (versions up to 3.0.0) allows an attacker with at least low privileges to upload files without proper restrictions on file types. This unrestricted file upload can be exploited to upload malicious files, potentially leading to full system compromise. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload malicious files, which can lead to complete compromise of the affected WordPress site, including data theft, data modification, and service disruption. The vulnerability affects all versions up to and including 3.0.0 of the plugin. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin functionality to trusted users only and consider disabling file upload features if possible. Monitor for vendor updates and apply patches promptly once released.