CVE-2024-37555 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: ZealousWeb. 📦 **Product**: Generate PDF using Contact Form 7 (WordPress Plugin). ⚠️ **Affected Versions**: **v4.0.6 and earlier**.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** specific PoC provided in the data. 🌐 **Status**: References point to vendor advisories. Wild exploitation is possible if auth is compromised, but no public script is listed here.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check WordPress Admin > Plugins. 2. Look for 'Generate PDF using Contact Form 7'. 3. Verify version number is **≤ 4.0.6**. 4. Scan for unauthorized file uploads in `wp-content/uploads`.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: **Yes**. 📥 **Action**: Update the plugin to the latest version (post-4.0.6). 🔗 **Source**: Check Patchstack or WordPress repository for the patched release.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable** the plugin immediately if not needed. 2. Restrict file upload permissions in `wp-config.php` or server config. 3. Implement strict WAF rules to block dangerous file extensions.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 📊 **CVSS**: 9.8 (Critical). ⏱️ **Priority**: Patch immediately. Even though auth is required, the impact is catastrophic. Do not ignore.

Updated May 08, 2026 CVSS 9.6 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Arbitrary File Upload vulnerability in 'Generate PDF using Contact Form 7'.
💥 **Consequences**: Attackers can upload malicious files (e.g., webshells).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type).
🔍 **Flaw**: The plugin fails to properly validate or restrict file types during upload.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: ZealousWeb.
📦 **Product**: Generate PDF using Contact Form 7 (WordPress Plugin).
⚠️ **Affected Versions**: **v4.0.6 and earlier**.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Upload arbitrary files (PHP shells, scripts).
🔓 **Privileges**: Gain remote code execution (RCE) on the server.
📂 **Data Access**: Read/modify sensitive site data, user credentials, and database …

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔐 **Auth Required**: **Yes** (PR:H - Privileges Required: High).
⚙️ **Config**: Low complexity (AC:L).…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: **No** specific PoC provided in the data.
🌐 **Status**: References point to vendor advisories. Wild exploitation is possible if auth is compromised, but no public script is listed here.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**:
Check WordPress Admin > Plugins.
Look for 'Generate PDF using Contact Form 7'.
Verify version number is **≤ 4.0.6**.
Scan for unauthorized file uploads in `wp-content/uploads`.

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Official Fix**: **Yes**.
📥 **Action**: Update the plugin to the latest version (post-4.0.6).
🔗 **Source**: Check Patchstack or WordPress repository for the patched release.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**:
**Disable** the plugin immediately if not needed.
Restrict file upload permissions in `wp-config.php` or server config.
Implement strict WAF rules to block dangerous file extensions.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**.
📊 **CVSS**: 9.8 (Critical).
⏱️ **Priority**: Patch immediately. Even though auth is required, the impact is catastrophic. Do not ignore.

Continue exploring

Vulnerability detail Full AI analysis (login) ZealousWeb CWE-434