Critical 9.8Published Oct 9, 2026

CVE-2026-94589Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

Updated under an hour ago (Oct 26, 2026, 6:10 PM ET)

Does this affect you?

It affects htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection). Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.66%, higher than 51% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)

Exploited in the last 30 days

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-434
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.66% (percentile 51)
Assigned by: Wordfence
NVD analysis: Deferred
Record last updated: Oct 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) htplugins:extensions_for_cf7_contact_form_7_database_conditional_fields_and_redirection (from the name)	through 3.4.5	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=cve
https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.form-data-store.php#L42
https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L222
https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/admin/include/class.cf7-signature.php#L82
https://plugins.trac.wordpress.org/browser/extensions-for-cf7/tags/3.4.5/includes/class.cf7-extensions.php#L289
https://plugins.trac.wordpress.org/changeset?reponame=&new=3727009%40extensions-for-cf7%2Ftags%2F3.4.6&old=3672142%40extensions-for-cf7%2Ftags%2F3.4.5
https://plugins.trac.wordpress.org/changeset/3727009/extensions-for-cf7/trunk/admin/include/class.cf7-signature.php

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.