The vulnerability is a Path Traversal flaw (CWE‑22) that permits an attacker to construct a file path that escapes the plugin’s intended directory and trigger download of any file readable by the web server. By requesting the download endpoint with a specially crafted path, the plugin will read the file and serve it to the requester, effectively providing arbitrary file disclosure. The flaw does not provide direct remote code execution, but it can compromise confidentiality and, if the attacker can target writable files, could lead to broader system compromise. The likely attack vector is exploiting the plugin’s public download endpoint without authentication, though this is inferred from the nature of the flaw.

The flaw affects the add‑ons.org PDF for Contact Form 7 WordPress plugin for all versions up to and including 7.1.0. WordPress sites that have the plugin installed and running a vulnerable version are impacted. The plugin is commonly used to generate PDFs of form submissions on WordPress websites.

The CVSS score of 7.5 indicates high severity due to significant confidentiality impact. The EPSS score is not available, so the likelihood of exploitation cannot be currently measured. The vulnerability is not listed in the CISA KEV catalog. Based on the public behavior of the plugin’s download endpoint, the attack vector is likely without authentication or with minimal credentials, which is inferred from the fact that the endpoint accepts arbitrary file names. This makes the exploit potentially low‑effort but the actual risk depends on server configuration and file permissions.