CVE-2026-90984: Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: "Generate PDF using Contact Form 7"to a version that resolves this vulnerability.Fixed in 4.2.2 - Compensating control
Restrict access to the WordPress page(s) that expose the "Generate PDF using Contact Form 7" form to authenticated users only (since versions before 4.2.2 are vulnerable to unauthenticated SSRF).
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit it by submitting crafted form content. No authenticated WordPress account is required.
What must be present for exploitation to be possible?
The affected plugin must be installed at a version before 4.2.2, and its PDF renderer must process submitted form content containing the crafted image destination.
What is the security impact?
An attacker can cause the WordPress server to request internal resources and obtain the returned response through the generated PDF.