CVE-2026-94666: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in ZealousWeb Generate PDF using Contact Form 7

The vulnerability identified as CVE-2026-94666 involves improper limitation of a pathname to a restricted directory (path traversal) in the ZealousWeb Generate PDF using Contact Form 7 plugin. Versions from initial release up to 4.2.1 are affected. This allows an unauthenticated attacker to read arbitrary files on the server by exploiting the path traversal flaw. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker can read sensitive files on the server by exploiting the path traversal vulnerability, potentially exposing confidential information. There is no impact on data integrity or service availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication.

A fix is available in version 4.2.2 of the Generate PDF using Contact Form 7 plugin. Users should upgrade to version 4.2.2 or later to remediate this vulnerability. No additional mitigation guidance is provided or required.