CVE-2026-94589Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
Updated under an hour ago ()
Does this affect you?
It affects htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection). Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.66%, higher than 50% of scored CVEs.
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.66% (percentile 50)
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Oct 11, 2026
- First seen by InfoSec Signals
- Oct 10, 2026
Affected products
htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) htplugins:extensions_for_cf7_contact_form_7_database_conditional_fields_and_redirection (from the name) | through 3.4.5 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cve
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.form-data-store.php#L42
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L222
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L82
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.cf7-extensions.php#L289
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3727009%40extensions-for-cf7%2Ftags%2F3.4.6&old=3672142%40extensions-for-cf7%2Ftags%2F3.4.5
- https://plugins.trac.wordpress.org/changeset/3727009/extensions-for-cf7/trunk/admin/include/class.cf7-signature.php
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.