WordPress Plugin Vulnerabilities

Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

Description

The plugin does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.

Proof of Concept

Affects Plugins

Plugin icon
generate-pdf-using-contact-form-7
Fixed in 4.2.2

References

CVE
CVE-2026-90984

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Artus KG
Submitter
Artus KG
Submitter twitter
artuskg
Verified
Yes
WPVDB ID
1aa459e4-bd75-49a5-a6de-812375d441e6

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2024-06-20
Title
WP Scraper < 5.8.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-07-29
Title
Edubin <= 9.2.0 - Unauthenticated Server-Side Request Forgery
Published
2024-04-22
Title
BuddyForms < 2.8.9 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
Published
2026-07-23
Title
3D Flipbook PDF Viewer & Embedder < 1.4.4 - Unauthenticated Server-Side Request Forgery
Published
2025-04-24
Title
Simple Google Photos Grid < 1.6 - Authenticated (Contributor+) Server-Side Request Forgery