Security Alert Summary
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is impacted by an arbitrary file upload vulnerability (CVE-2026-94589). In affected versions up to and including 3.4.5, a missing set of validation checks in the signature upload handling allows unauthenticated attackers to upload files that may be executable, which can lead to remote code execution.
CVE Details
- CVE ID: CVE-2026-94589
- Affected component: Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress
- Affected versions: All versions up to and including 3.4.5
- Published: October 10, 2026 at 4:18:19 AM UTC
- Last modified: October 10, 2026 at 4:18:19 AM UTC
- CVSS v3.1: Base Score 9.8, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-434
Technical Details
The vulnerability exists in the plugin’s handling of uploaded signature files. Specifically, the extcf7_submit flow relies on a validation_filter() for the signature field that lacks proper file extension, MIME type, and size validation. In addition, the upload directory does not enforce PHP-execution guards and a sanitize_file_name() bypass was identified that can convert names like “shell.php-” into “shell.php”. These issues together allow an unauthenticated attacker to upload files that may be executable on the server, making remote code execution possible.
The described failure modes are: missing file extension/MIME/size validation in the signature upload check, a sanitize_file_name() bypass that normalizes potentially dangerous filenames to executable names, and the absence of server-side protections that prevent execution of uploaded PHP files in the plugin upload location.
How This Could Impact Your Website
On a typical WordPress site using this plugin, an unauthenticated attacker could upload a malicious file via the plugin’s signature upload handling. In a multi-user environment this could mean:
- The site owner may be unaware that a malicious file was uploaded to a plugin-controlled directory.
- Internal staff or contributors could continue to use the affected form functionality, exposing the site to execution of the uploaded file.
- An external contractor or contributor could be targeted with phishing messages leveraging exposed site content or user lists obtained during follow-on activity.
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering based on site data or access gained through uploaded code. If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and limit file upload capabilities to trusted users only.
- Ensure upload directories are configured to prevent execution of PHP or other executable files.
- Monitor site activity and file system changes for unusual behavior or unexpected uploads.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L222
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L82
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.cf7-extensions.php#L289
- https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.form-data-store.php#L42
- https://plugins.trac.wordpress.org/changeset/3727009/extensions-for-cf7/trunk/admin/include/class.cf7-signature.php
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3727009%40extensions-for-cf7%2Ftags%2F3.4.6&old=3672142%40extensions-for-cf7%2Ftags%2F3.4.5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cve
