Improper Limitation of a Pathname to a Restricted Directory allows an attacker to manipulate the file download functionality of the ZealousWeb Generate PDF using Contact Form 7 plugin to request files outside the intended directory. This path traversal flaw permits the download of arbitrary files, potentially exposing sensitive system or user data and compromising confidentiality. The vulnerability represents a classic CWE-22 weakness.

The vulnerability affects the ZealousWeb Generate PDF using Contact Form 7 plugin from its earliest release up through version 4.2.1. Any WordPress installation hosting these plugin versions is at risk.

The CVSS score of 7.5 indicates a high severity impact with considerable potential damage. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is a remote HTTP request to the plugin’s file download endpoint that includes a traversal string; the attacker need not authenticate to trigger the flaw.