WordPress security changelog
CRITICAL CVE-2026-94589 Deferred

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Dangerous file upload

An unauthenticated caller can reach extcf7_submit with a signature upload. validation_filter lacks effective extension, MIME and size checks, and filename canonicalization can be bypassed; the destination also lacks protection against script execution. This permits an executable PHP upload and server-side code execution. The export does not require a logged-in account. Affected versions: <= 3.4.5. The matching official changelog confirms 3.4.6 as fixed for this CVE.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
Plugin slug
extensions-for-cf7
Affected
<= 3.4.5
Safe version
3.4.6
Published
Oct 10, 2026
Weakness
CWE-434 — Unrestricted Upload of File with Dangerous Type

This CVE was published Oct 10, 2026 and is one of 6 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to 3.4.6 or a later supported release. Application-level remediation: Validate and re-encode signatures as supported images, use server-generated filenames and size limits, and store uploads where scripts cannot execute.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources