RedefiningTheWeb vulnerabilities
We track 5 vulnerabilities in RedefiningTheWeb products across 6 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on December 18, 2025.
Latest RedefiningTheWeb vulnerabilities
- 9.9 Critical severity
WordPress Contact Form 7 PDF, Google Sheet &…: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sh
- 7.6 High severity
BMA Lite: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-and-scheduling allows SQL Injection.This issue affects BMA Lite: from n/a through <= 1.4.2.
- 7.5 High severity
PDF Generator Addon for Elementor Page Builder: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Path Traversal.This issue affects PDF Generato
- 7.5 High severity
PDF Generator for WordPress Elementor: Improper Limitation of a Pathname to a Restricted Directory
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the conten
- 9.8 Critical severity
WordPress & WooCommerce Affiliate Program: Missing Authentication for Critical Functionality
The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior