CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
Explanation of Vulnerability in Simple Terms
The Generate PDF using Contact Form 7 plugin for WordPress allows authenticated administrators to upload files without proper validation. An attacker with admin privileges can upload malicious files that may be executed on the server, potentially compromising the entire site. The vulnerability affects all versions up to 4.1.2.
What an attacker can do
Upload and execute malicious files on the server with admin-level access.
Potential impact on your site
A compromised admin account can lead to full site takeover, data theft, or malware installation.
Conditions required to exploit
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
