CVE-2026-94664: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in add-ons.org PDF for Contact Form 7

The vulnerability identified as CVE-2026-94664 involves improper limitation of a pathname to a restricted directory in the PDF for Contact Form 7 plugin. This path traversal flaw allows an attacker to manipulate file paths to access files outside the designated directory scope. The affected versions include all releases from the initial version up to but not including 7.2.0. The CVSS v3.1 base score is 7.5, indicating a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read arbitrary files on the server where the plugin is installed, potentially exposing sensitive information. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider restricting access to the plugin or server directories as a temporary measure.